********** KNOWLEDGE BASE ARTICLE PREVIEW **********

Customers Only - Do not share publicly before CVEs are published on July 22, 2026

Description

[Critical Security Bulletin] [July 2026]   CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184, CVE-2026-13185, CVE-2026-13186, CVE-2026-13190

Progress Telerik UI for AJAX 2026 Q2 (2026.2.519) or earlier.

Multiple high security vulnerabilities have been confirmed in Telerik UI for ASP.NET AJAX affecting the RadAsyncUpload, RadPersistenceManager, and RadDockLayout components. When chained together, these vulnerabilities can allow an unauthenticated remote attacker to achieve Remote Code Execution (RCE) on the server hosting the application. This article describes the combined attack chain, its impact, and the actions required to remediate or mitigate the risk.

What Are the Symptoms?

There are no visible symptoms. These vulnerabilities can be exploited silently without causing application errors visible to the application owner. Successful exploitation leaves no obvious trace in standard ASP.NET error logs.

What Are the Impacts?

An unauthenticated remote attacker who successfully exploits this vulnerability chain can execute arbitrary code on the web server with the privileges of the application pool identity. This may result in full server compromise, data exfiltration, or further lateral movement within the hosting environment.

Affects

Component	Affected Version	Fixed Version
RadAsyncUpload	>= 2010.1.309 && <= 2026.2.519	>= 2026.2.708 (2026 Q2 SP1)
RadPersistenceManager	>= 2013.1.220 && <= 2026.2.519	>= 2026.2.708 (2026 Q2 SP1)
RadDockLayout	>= 2013.1.220 && <= 2026.2.519	>= 2026.2.708 (2026 Q2 SP1)

Our only official recommendation is to upgrade to the patched release following the Upgrade to a Newer Version documentation. If you cannot upgrade immediately, visit the Mitigation section for temporary mitigation options.

If you have any questions or concerns related to this issue, please log in to open a new Technical Support case. If your version is no longer supported as part of the Telerik UI for ASP.NET AJAX Release History, you should upgrade to a supported and fixed version.

Issue

In Progress Telerik UI for ASP.NET AJAX before version 2026.2.708 (2026 Q2 SP1), multiple vulnerabilities in RadAsyncUpload, RadPersistenceManager, and RadDockLayout can be combined by an unauthenticated remote attacker to achieve Remote Code Execution on the server.

Solution

We have addressed the vulnerabilities and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table above.

For all customers on a current maintenance agreement, the upgrade can be accessed by logging into the Product Downloads | Your Account. Customers that are not on a current maintenance agreement should contact a Progress account representative.

To confirm your current version of Telerik UI for ASP.NET AJAX, open your project in Visual Studio and check the version of Telerik.Web.UI.dll in the References, or see How to determine which version of Telerik UI for ASP.NET AJAX you are using.

Mitigation

If you cannot upgrade immediately, apply all applicable mitigations from the checklist below.

#	Check	Applies to
1	customErrors is RemoteOnly or On in Web.config	All apps with RadAsyncUpload
2	Carefully review any use of  Telerik.AsyncUpload.ConfigurationEncryptionKey  Telerik.Upload.ConfigurationHashKey or  Telerik.Web.UI.DialogParametersEncryptionKey	All apps with RadAsyncUpload
3	RadPersistenceManager does not use CookieStateStorageProvider; RadDockLayout.LayoutPersistenceRepositoryType is not Cookies	Apps using PersistenceFramework
4	StorageProviderKey is not derived from Request data	Apps using AppDataStorageProvider
5	Telerik.AsyncUpload.TemporaryFolder points outside App_Data (defense-in-depth)	Apps with both RadAsyncUpload and RadPersistenceManager

Important This is intended as a temporary stopgap until you can update the application to use the new release, do not rely on mitigation as a long-term strategy.

Mitigation 1 - Set customErrors to RemoteOnly or On

<system.web>

</system.web>

Mitigation 2- Custom Keys in Web.config

The  RELEVANT_KEY  references below refers to any of Telerik.AsyncUpload.ConfigurationEncryptionKey, Telerik.Upload.ConfigurationHashKey, or Telerik.Web.UI.DialogParametersEncryptionKey in web.config.

Using v2026.2.514 and earlier:

Vulnerable Scenario 1 - If you are using a RELEVANT_KEY in web.config

1. Remove RELEVANT_KEY from web.config, to fall back on MachineKey.Unprotect with AES + HMAC

2. Continue to Instructions - Generating Strong Machine Keys section

Vulnerable Scenario 2 - If you are not using RELEVANT_KEY

1. Continue to Instructions - Generating Strong Machine Keys section

Using v2026.2.708 and later:

Option 1 - You can use RELEVANT_KEY again, it provides stronger protection than machineKey, via AES-GCM

Option 2 - Remove RELEVANT_KEY to use machineKey, while not as strong as GCM, it is useful for webfarm environments, and you can use the "autogenerate keys at runtime" again.

Instructions - Generating Strong Machine Keys

AES + HMAC support and framework-managed key material via machine key config. even a strong custom key will not prevent padding oracle attacks. Critical - You must manually generate the keys in IIS, using the Autogenerate creates the same HMAC guard collapse as #1

1. Open IIS > select your site > select Machine Key

2. Validation method: choose HMACSHA256

3. Automatically generate at runtime checkboxes: uncheck both (very important!)

4. In the right pane, click Generate Keys 

5. In the right pane, click Apply

6. In the left pane, select Application Pools and recycle the relevant App Pool (very important)

See Mandatory web.config settings for requirements and key generation guidance.

Mitigation 2.5 Disable the upload handler if not in use

</appSettings>

Mitigation 3 - Do not use cookie-based persistence storage

For RadPersistenceManager - remove any CookieStateStorageProvider configuration. The default AppDataStorageProvider is safe:

// Page_Init

PersistenceManager1.StorageProvider =

new AppDataStorageProvider(Server.MapPath("~/App_Data/PersistenceState/"));

For RadDockLayout - ensure LayoutPersistenceRepositoryType is not Cookies:

RadDockLayout1.LayoutPersistenceRepositoryType =

DockLayoutPersistenceRepository.FileSystem;

Mitigation 4 - Do not derive StorageProviderKey from user input

// UNSAFE - never do this

// PersistenceManager1.StorageProviderKey = Request.QueryString["userId"];

// Safe - hardcoded key

PersistenceManager1.StorageProviderKey = "my-app-persistence-state";

The default key (TelerikAspNetRadControlsPersistedState) is safe if you have not overridden it.

Mitigation 5 - Move RadAsyncUpload temp folder outside App_Data (defense-in-depth)

</appSettings>

Create the folder manually and grant write permissions to the application pool identity. This is defense-in-depth only - always apply Mitigation 4 first.

Notes

If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.

We would like to thank TantoSec (Marcio Almeida, Justin Steven) and CODE WHITE GmbH (Markus Wulftange) for responsibly disclosing these vulnerabilities and assisting in their resolution.