Introduction
Knowledge Base
Knowledge Base / Critical Security Bulletin - Multiple Vulnerabilities Chained to Remote Code Execution (July 2026)
New to Telerik UI for ASP.NET AJAX? Start a free 30-day trial

Critical Security Bulletin - Multiple Vulnerabilities Chained to Remote Code Execution (July 2026)

Updated on Jul 22, 2026

Description

[Critical Security Bulletin] – [July 2026] – CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184, CVE-2026-13185, CVE-2026-13186, CVE-2026-13190

  • Progress® Telerik® UI for AJAX 2026 Q2 (2026.2.519) or earlier.

Multiple high security vulnerabilities have been confirmed in Telerik UI for ASP.NET AJAX affecting the RadAsyncUpload, RadPersistenceManager, and RadDockLayout components. When chained together, these vulnerabilities can allow an unauthenticated remote attacker to achieve Remote Code Execution (RCE) on the server hosting the application. This article describes the combined attack chain, its impact, and the actions required to remediate or mitigate the risk.

What Are the Symptoms?

There are no visible symptoms. These vulnerabilities can be exploited silently without causing application errors visible to the application owner. Successful exploitation leaves no obvious trace in standard ASP.NET error logs.

What Are the Impacts?

An unauthenticated remote attacker who successfully exploits this vulnerability chain can execute arbitrary code on the web server with the privileges of the application pool identity. This may result in full server compromise, data exfiltration, or further lateral movement within the hosting environment.

Affects

ComponentAffected VersionFixed Version
RadAsyncUpload>= 2010.1.309 && <= 2026.2.519>= 2026.2.708 (2026 Q2 SP1)
RadPersistenceManager>= 2013.1.220 && <= 2026.2.519>= 2026.2.708 (2026 Q2 SP1)
RadDockLayout>= 2013.1.220 && <= 2026.2.519>= 2026.2.708 (2026 Q2 SP1)

Our only official recommendation is to upgrade to the patched release following the Upgrade to a Newer Version documentation. If you cannot upgrade immediately, visit the Mitigation section for temporary mitigation options.

If you have any questions or concerns related to this issue, please log in to open a new Technical Support case. If your version is no longer supported as part of the Telerik UI for ASP.NET AJAX Release History, you should upgrade to a supported and fixed version.

Issue

  • CWE-326: Inadequate Encryption Strength
  • CWE-502: Deserialization of Untrusted Data
  • CWE-22: Improper Limitation of a Pathname ('Path Traversal')

In Progress Telerik UI for ASP.NET AJAX before version 2026.2.708 (2026 Q2 SP1), multiple vulnerabilities in RadAsyncUpload, RadPersistenceManager, and RadDockLayout can be combined by an unauthenticated remote attacker to achieve Remote Code Execution on the server.

Solution

We have addressed the vulnerabilities and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table above.

For all customers on a current maintenance agreement, the upgrade can be accessed by logging into the Product Downloads | Your Account. Customers that are not on a current maintenance agreement should contact a Progress account representative.

To confirm your current version of Telerik UI for ASP.NET AJAX, open your project in Visual Studio and check the version of Telerik.Web.UI.dll in the References, or see How to determine which version of Telerik UI for ASP.NET AJAX you are using.

Mitigation

If you cannot upgrade immediately, apply all applicable mitigations from the checklist below.

#CheckApplies to
1customErrors is RemoteOnly or On in Web.configAll apps with RadAsyncUpload
2Carefully review any use of Telerik.AsyncUpload.ConfigurationEncryptionKey, Telerik.Upload.ConfigurationHashKey, or Telerik.Web.UI.DialogParametersEncryptionKeyAll apps with RadAsyncUpload
3RadPersistenceManager does not use CookieStateStorageProvider; RadDockLayout.LayoutPersistenceRepositoryType is not CookiesApps using PersistenceFramework
4StorageProviderKey is not derived from Request dataApps using AppDataStorageProvider
5Telerik.AsyncUpload.TemporaryFolder points outside App_Data (defense-in-depth)Apps with both RadAsyncUpload and RadPersistenceManager

This is intended as a temporary stopgap until you can update the application to use the new release, do not rely on mitigation as a long-term strategy.

Mitigation 1 - Set customErrors to RemoteOnly or On

xml
<system.web>
  <customErrors mode="RemoteOnly" />
</system.web>

Mitigation 2- Custom Keys in Web.config

The RELEVANT_KEY references below refers to any of Telerik.AsyncUpload.ConfigurationEncryptionKey, Telerik.Upload.ConfigurationHashKey, or Telerik.Web.UI.DialogParametersEncryptionKey in web.config.

Using v2026.2.514 and earlier:

Using v2026.2.708 and later:

  • Option 1 - You can use RELEVANT_KEY again, it provides stronger protection than machineKey, via AES-GCM
  • Option 2 - Remove RELEVANT_KEY to use machineKey, while not as strong as GCM, it is useful for webfarm environments, and you can use the "autogenerate keys at runtime" again.

Instructions - Generating Strong Machine Keys

AES + HMAC support and framework-managed key material via machine key config. even a strong custom key will not prevent padding oracle attacks. Critical - You must manually generate the keys in IIS, using the Autogenerate creates the same HMAC guard collapse as #1

  1. Open IIS > select your site > select Machine Key
  2. Validation method: choose HMACSHA256
  3. Automatically generate at runtime checkboxes: uncheck both (very important!)
  4. In the right pane, click Generate Keys 
  5. In the right pane, click Apply
  6. In the left pane, select Application Pools and recycle the relevant App Pool (very important)

See Mandatory web.config settings for requirements and key generation guidance.

Mitigation 2.5 Disable the upload handler if not in use

xml
<appSettings>
  <add key="Telerik.Web.DisableAsyncUploadHandler" value="true" />
</appSettings>

For RadPersistenceManager - remove any CookieStateStorageProvider configuration. The default AppDataStorageProvider is safe:

csharp
// Page_Init
PersistenceManager1.StorageProvider =
    new AppDataStorageProvider(Server.MapPath("~/App_Data/PersistenceState/"));

For RadDockLayout - ensure LayoutPersistenceRepositoryType is not Cookies:

csharp
RadDockLayout1.LayoutPersistenceRepositoryType =
    DockLayoutPersistenceRepository.FileSystem;

Mitigation 4 - Do not derive StorageProviderKey from user input

csharp
// UNSAFE - never do this
// PersistenceManager1.StorageProviderKey = Request.QueryString["userId"];

// Safe - hardcoded key
PersistenceManager1.StorageProviderKey = "my-app-persistence-state";

The default key (TelerikAspNetRadControlsPersistedState) is safe if you have not overridden it.

Mitigation 5 - Move RadAsyncUpload temp folder outside App_Data (defense-in-depth)

xml
<appSettings>
  <add key="Telerik.AsyncUpload.TemporaryFolder" value="~/UploadTemp" />
</appSettings>

Create the folder manually and grant write permissions to the application pool identity. This is defense-in-depth only - always apply Mitigation 4 first.

Notes

  • If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
  • We would like to thank TantoSec (Marcio Almeida, Justin Steven) and CODE WHITE GmbH (Markus Wulftange) for responsibly disclosing these vulnerabilities and assisting in their resolution.

External References

The following individual vulnerabilities contribute to the chained RCE scenario described above. Each has a dedicated KB article with per-vulnerability details.

CVE-2026-13181 (High) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS: 8.1 / High

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution.

Discoverer Credit: Marcio Almeida of TantoSec

CVE-2026-13182 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS: 7.5 / High

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, enabling a padding oracle that may be used to forge valid encrypted payloads.

Discoverer Credit: Marcio Almeida of TantoSec

CVE-2026-13183 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS: 7.5 / High

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling a timing oracle that may be used to forge valid encrypted payloads.

Discoverer Credit: Justin Steven and Marcio Almeida of TantoSec

CVE-2026-13184 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS: 7.5 / High

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.

Discoverer Credit: Marcio Almeida of TantoSec

CVE-2026-13185 (High) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS: 8.1 / High

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled persistence state via unsafe type resolution, which can lead to remote code execution.

Discoverer Credit: Markus Wulftange of CODE WHITE GmbH

CVE-2026-13186 (High) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS: 8.1 / High

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling loading of attacker-uploaded files into the deserialization pipeline.

Discoverer Credit: Markus Wulftange of CODE WHITE GmbH

CVE-2026-13190 (High) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS: 8.1 / High

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.

Discoverer Credit: Progress Telerik Security Team

In this article
DescriptionWhat Are the Symptoms?What Are the Impacts?AffectsIssueSolutionMitigationMitigation 1 - Set customErrors to RemoteOnly or OnMitigation 2- Custom Keys in Web.configMitigation 2.5 Disable the upload handler if not in useMitigation 3 - Do not use cookie-based persistence storageMitigation 4 - Do not derive StorageProviderKey from user inputMitigation 5 - Move RadAsyncUpload temp folder outside App_Data (defense-in-depth)NotesExternal ReferencesRelated CVEs
Not finding the help you need?
Contact Support