Telerik RadAsyncUpload RCE: hardening is the precondition

Security firm Tanto Security published a working exploit chain on September 7 that turns an AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution. Progress patched the bugs in July. The twist that makes this Telerik RadAsyncUpload RCE worth your evening: the sites that are exploitable are the ones that followed the vendor's own hardening advice.

What actually happened

Progress shipped fixes in 2026.2.708 (2026 Q2 SP1) on July 8 and published a critical security bulletin on July 22 covering seven CVEs across three controls. Four of them sit in RadAsyncUpload: CVE-2026-13181 (unsafe .NET type resolution, CVSS 8.1), CVE-2026-13182 (padding oracle, 7.5), CVE-2026-13183 (a timing variant, 7.5), and CVE-2026-13184 (predictable default key, 7.5). Affected versions run from 2010.1.309 through 2026.2.519 — sixteen years of builds.

What changed on September 7 is the method. Tanto Security's Marcio Almeida walked the full chain and released telerik-rau-exploit, a Go tool plus mixed-mode DLL payloads. The oracle recovers the encryption key, the attacker names an arbitrary .NET type that the control resolves without an allowlist, and the deserialized gadget loads an attacker-supplied DLL that runs native code the moment it loads.

Now the precondition. Tanto is explicit that a default installation is not exploitable. You need a reachable page with a RadAsyncUpload control whose FileUploaded handler reads UploadResult, and you need an explicit, non-default Telerik.AsyncUpload.ConfigurationEncryptionKey set in config. That key is the hardening step Telerik told everyone to apply after CVE-2017-11317, when the hardcoded default key was the bug. Do nothing for nine years and you are fine. Follow the advisory and you are in the blast radius.

No confirmed in-the-wild exploitation, and nothing in CISA's KEV catalog as of September 7. That is a window, not an all-clear.

Why it matters for your business

Telerik is invisible infrastructure. It ships inside line-of-business ASP.NET apps that a contractor built in 2016 and nobody has opened since. If you run a legacy .NET app — inventory, quoting, a customer portal, a scheduling tool — you may own this and not know it.

Three things:

Find out if you have it. Search your web roots for Telerik.Web.UI.dll and read its file version. Anything below 2026.2.708 is in range.

Check the two preconditions before you panic, and patch anyway. If ConfigurationEncryptionKey is set in web.config, you are the target profile. If it is not, you have time — but the same DLL carries RadPersistenceManager and RadDockLayout bugs (CVE-2026-13185, 13186, 13190, all 8.1) with their own conditions.

Treat the vendor's stopgaps as stopgaps. Progress lists mitigations — customErrors on, StorageProviderKey not derived from request data, TemporaryFolder outside App_Data — and says plainly not to rely on them long-term. The upgrade is the fix.

The broader lesson is uncomfortable and worth sitting with: security guidance has a shelf life. A config line that was correct in 2017 became the enabling condition in 2026. Nobody re-audits a hardening step once it is checked off, which is exactly why this one survived nine years.

Sources: Progress Telerik security bulletin, Tanto Security.