Critical Telerik Sitefinity RCE Flaw Lets Unauthenticated Attackers Take Over Servers

Key Takeaways

• A critical vulnerability chain in Telerik UI for ASP.NET AJAX allows unauthenticated remote code execution.
• The flaw impacts the RadAsyncUpload component, affecting versions 2010.1.309 through 2026.2.519.
• The vulnerability, tracked across four CVEs, requires specific conditions for exploitation, including a configured encryption key and an active server-side file upload handler.
• Progress Software released a fix in version 2026.2.708 (2026 Q2 SP1 update).

Cybersecurity researchers have uncovered a severe chain of vulnerabilities within Telerik UI for ASP.NET AJAX, enabling unauthenticated attackers to achieve remote code execution (RCE) on enterprise web applications. This critical flaw primarily resides in the widely deployed RadAsyncUpload component, a file-upload control integral to many ASP.NET WebForms applications.

Progress Software, the vendor behind Telerik, has confirmed that the affected versions range from 2010.1.309 up to 2026.2.519. A patch was subsequently released in version 2026.2.708, included in the 2026 Q2 SP1 update.

The Vulnerability Chain

The identified attack vector comprises four distinct vulnerabilities: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. While these issues are serious, their successful exploitation is contingent on specific environmental factors and cannot be universally applied to all default Telerik installations.

Central to this vulnerability chain is CVE-2026-13182, a padding oracle vulnerability found in the RadAsyncUpload component’s handling of encrypted client states. Telerik utilizes AES-CBC encryption to secure configuration data transmitted between the server and the user’s browser. A padding oracle vulnerability arises when an application exhibits differing error messages or behaviors in response to valid versus invalid encrypted data. In this scenario, malformed data triggers a distinct error compared to valid padding combined with invalid JSON content.

This subtle discrepancy allows an attacker to repeatedly submit modified ciphertext. By observing the application’s responses, they can progressively deduce how the encrypted data is being decrypted. This process ultimately enables them to recover sensitive information and forge new, modified encrypted values without possessing the original encryption key. Even with ASP.NET’s customErrors feature enabled, researchers noted that exploitation remains feasible, albeit more challenging and time-consuming, by employing timing analysis to discern the error differences.

Leveraging this oracle, researchers demonstrated how to manipulate Telerik’s serializedConfiguration data, which dictates the settings of the upload control. This manipulation allowed them to alter the AllowedFileExtensions field, thereby permitting the upload of DLL files. The attack employed a CBC forgery technique, inserting a “sacrificial” encrypted block within a JSON string. This method preserved essential configuration data from legitimate page loads, including session controls, while simultaneously injecting malicious entries into the configuration.

The second critical component of the chain, CVE-2026-13181, involves the management of upload metadata. Here, Telerik’s framework resolves the .NET type name provided via the AsyncUploadTypeName value without adequate allowlisting. If a server-side FileUploaded handler attempts to read the UploadResult property, Telerik will deserialize the crafted malicious data into the specified type. This behavior can be combined with the System.Configuration.Install.AssemblyInstaller gadget, forcing the application to load an uploaded mixed-mode DLL from a temporary directory. This action then enables the execution of native code through its DllMain entry point.

The proof-of-concept demonstrated successful execution of a web shell within the IIS worker process. An alternative in-memory variant was also shown to execute commands without writing any files to disk, making detection more challenging.

Successful exploitation of this vulnerability chain requires several conditions to be met: attackers must access a page containing a RadAsyncUpload control that has an active server-side FileUploaded event handler configured to read the UploadResult. Additionally, an explicit, non-default Telerik.AsyncUpload.ConfigurationEncryptionKey must be configured, a setting typically recommended as a security best practice, for the exploit path to function.

What You Should Do

• Immediately upgrade Telerik UI for ASP.NET AJAX to version 2026.2.708 or newer.
• Administrators should meticulously identify all pages utilizing the RadAsyncUpload control and review their upload event handlers for any suspicious activity or misconfigurations.
• Implement robust monitoring for unusual IIS activity, specifically looking for instances where w3wp.exe unexpectedly spawns cmd.exe, the appearance of unapproved DLL files in temporary directories, or unexpected .aspx files in web root folders.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.