Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

Summary

A proof-of-concept exploit chain for Telerik UI for ASP.NET AJAX allows unauthenticated RCE, but requires specific non-default configurations. Progress Software patched the vulnerabilities in July, and no exploitation in the wild has been confirmed.

Key Takeaways

1. A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution.
2. Progress Software patched the flaws in July, and exploitation requires a non-default configuration — but the release pairs a detailed write-up with a ready-to-run tool and two payloads, putting a complete attack path in public hands for the first time.
3. There are no confirmed reports of the 2026 flaws being exploited in the wild, and none appears in CISA's Known Exploited Vulnerabilities catalog as of September 7.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents technical details about a security vulnerability and its exploit. It cites specific CVEs, software versions, and security firms, lending it a high degree of credibility. The information is presented factually with clear explanations of the technical aspects.

Bias assessment: Technical Security Reporting. The article focuses on the technical details of a cybersecurity vulnerability and its exploit. It maintains an objective tone, reporting facts and expert findings without overt emotional language or political framing. The primary lens is that of security analysis.

Note: This article details a technical vulnerability and exploit. Verification of specific application configurations is crucial for assessing real-world risk.

Credibility flag: Technical, Verify Configuration

Claimed Facts (7)

• This statement presents a factual account of the exploit's capability and the vendor's response.
• This details the vendor's action and the public release of exploit tools.
• This is a factual statement about the nature of the vulnerabilities.
• This provides specific dates and version numbers for the patch and disclosure.
• This statement factually outlines the affected software versions.
• This provides a specific CVE, its severity score, and an explanation of its complexity rating.
• This details the timeline of reporting, fixing, and disclosure.

Opinions (5)

• While factual in reporting the release, the phrasing 'What changed...' and the description of the tool's function leans towards interpretation of the event's significance.
• This statement offers an interpretation of why the vulnerability is noteworthy, based on past events.
• This is a recommendation for action, presented as the best course of action.
• This summarizes Progress's stance and warning, which includes an opinion on the effectiveness of custom keys.
• This provides advice and guidance on how to detect exploitation, based on the vendor's warning.

Claims (5)

• This claim is presented with significant caveats, questioning its substantiation and distinguishing it from confirmed exploitation.
• While likely true in a technical context, the immediacy implied by 'as soon as it loads' could be an oversimplification or a slight exaggeration for dramatic effect.
• The phrasing 'It is not instant' is a subjective statement used to qualify the previous claim, and the time estimates are presented without direct verification.
• This describes a method of exploitation that relies on subtle timing differences, which can be difficult to definitively prove or measure without direct access to the target.
• The claim of naming an 'arbitrary' .NET type and resolving it 'without an allowlist' suggests a level of unchecked access that, while technically possible in some scenarios, can be a strong claim without further context on the specific limitations.

Key Sources

• The Hacker News — Cybersecurity News Outlet
• TantoSec — Security Firm
• Progress Software — Software Vendor
• Marcio Almeida — Security Researcher at TantoSec
• CISA — Cybersecurity and Infrastructure Security Agency
• IONIX — Attack-Surface-Management Vendor
• CODE WHITE — Security Research Group
• Markus Wulftange — Security Researcher at CODE WHITE
• Justin Steven — Colleague at TantoSec