Reported by 2 outlets
Telerik UI AES-CBC Padding Oracle Chain Enables Unauthenticated RCE
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Telerik UI Flaws Let Attackers Chain AES-CBC Padding Oracle to Unauthenticated RCE
gbhackers.com · 36d ago · September 7th, 2026
Security researchers have identified a critical vulnerability chain in Progress Telerik UI for ASP.NET AJAX, which allows unauthenticated attackers to escalate from a cryptographic padding oracle to remote code execution on exposed web applications. Documented by Tanto Security researcher Marcio Almeida, this vulnerability affects Telerik UI for ASP.NET AJAX versions 2010.1.309 through 2026.2.519. To address […] The post Telerik UI Flaws Let Attackers Chain AES-CBC Padding Oracle to Unauthenticated RCE appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Telerik UI Flaws Chain AES-CBC Padding Oracle to Unauthenticated Remote Code Execution
cyberpress.org · 36d ago · September 7th, 2026
The issue affects Telerik UI for ASP.NET AJAX releases from 2010.1.309 through 2026.2.519; Progress Software says version 2026.2.708 (2026 Q2 SP1) prevents exploitation of the chain. Security researcher Marcio Almeida found that RadAsyncUpload processes encrypted client-controlled state using AES-CBC and PKCS#7 padding. Telerik UI Flaws Chain AES-CBC Padding Oracle The affected code exposes different behavior when ciphertext has invalid padding versus when it has valid padding but decrypts to malformed JSON. That distinction creates a padding oracle: an attacker can repeatedly modify encrypted data and use server responses, or response timing, to infer plaintext and ultimately construct chosen encrypted values without possessing the encryption key. The chain centers on RadAsyncUpload state, including the encrypted _serializedConfiguration and metaData fields. CBC encryption alone does not provide integrity protection. CBC chains (Source: tantosec) Because Telerik accepted tampered ciphertext before the patch, the oracle could be used to recover intermediate block values and forge parts of a configuration object. Researchers used a genuine server-issued configuration prefix, a “sacrificial” corrupted block within a JSON key, and then appended a controlled suffix. This allowed them to overr