Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

Summary

Security firm TantoSec released a public proof-of-concept exploit chaining an AES-CBC padding oracle to remote code execution in Telerik UI for ASP.NET AJAX. Exploitation requires specific non-default hardening configurations and has no confirmed in-the-wild abuse following a July 2026 patch by Progress Software.

Key Takeaways

1. Security firm TantoSec has published a working exploit chain targeting vulnerabilities in Telerik UI for ASP.NET AJAX that can allow an unauthenticated attacker to execute remote code on the server hosting a vulnerable application.
2. Running an affected version is not enough to be exploitable. TantoSec says the chain has "preconditions that are not met by a default installation": a page must render a RadAsyncUpload control whose server-side handler reads the upload result, and the application must be configured with an explicit, non-default encryption key for the control
3. Upgrade to Telerik UI for ASP.NET AJAX 2026.2.708 (2026 Q2 SP1) or later, which replaces the flawed AES-CBC scheme with authenticated encryption and closes the entire chain.

Statement Breakdown

• Claimed Facts: 80% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 5% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on official advisories from Progress Software, technical disclosures from TantoSec, and government references such as CISA. It clearly separates confirmed facts from vendor claims. The technical chain and prerequisites are explained with high precision.

Bias assessment: Technical Security Analysis. The reporting maintains a neutral, technical perspective focused on software security and patch management. It avoids sensationalism by explicitly clarifying that exploitation requires a non-default configuration and has not been observed in the wild. The tone is informative and measured.

Note: Covers verified technical vulnerabilities and vendor patch advisories with clear configuration prerequisites.

Credibility flag: Verified Advisory

Claimed Facts (5)

• Checkable historical timeline for vendor patch release and CVE publication.
• Verifiable list of affected software version ranges.
• Official CVSS rating and vulnerability metrics published in the advisory.
• Empirical lab performance measurement documented by the security researchers.
• Verifiable status of the vulnerability within public federal threat tracking databases.

Opinions (5)

• Reflects the vendor's policy guidance and technical evaluation of workaround risks.
• Editorial interpretation explaining why the security community prioritizes this component.
• Prescriptive defensive recommendations based on vendor assessments of logging limitations.
• Subjective characterization describing the security impact of meeting exploit preconditions.
• Technical evaluation regarding the practical viability of alternative timing attack vectors.

Claims (5)

• Unsubstantiated vendor statement lacking technical evidence, dates, or differentiation from scanning.
• Highlights counterintuitive vendor advice where recommended hardening inadvertently enables an exploit prerequisite.
• Contrasts a severe unauthenticated remote execution claim with narrow prerequisite caveats.
• Describes public weaponization tooling that carries elevated risk of unvalidated abuse.
• Mentions an alternative attack path without detailed public proof or verification in the main demo.

Key Sources

• Progress Software — Software vendor developing Telerik UI
• TantoSec — Cybersecurity research firm
• Marcio Almeida — Security Researcher at TantoSec
• Swati Khandelwal — Author at The Hacker News
• IONIX — Attack surface management vendor