Telerik UI Flaw Turns Into RCE — But Only If You Missed This Patch

Emily Davis · 2026-09-07

### The Bug That Chained Two Problems Into One Big Headache So here's the deal. A security firm called TantoSec just dropped a proof-of-concept that takes a "padding oracle" bug in Telerik UI for ASP.NET AJAX and turns it into full unauthenticated remote code execution. Sounds scary, right? Well, hold on. There's a pretty big catch. This only works against applications running a specific non-default configuration. And Progress — the company behind Telerik — already patched the whole chain back in July. So if you've kept up with updates, you're probably fine. Still, it's worth understanding what happened here, because these kinds of chained exploits are becoming more common. ### What Exactly Is a Padding Oracle, Anyway? Let me break this down without the jargon. A padding oracle is basically a side-channel leak. When an application uses AES-CBC encryption (a common way to scramble data), it sometimes gives away tiny clues about whether decrypted data looks right or wrong. Those clues don't seem like much on their own. But string enough of them together, and an attacker can decrypt data they shouldn't see — or even forge their own encrypted payloads. Think of it like a lock that clicks a little differently depending on which part of the key you got right. You can't see the key, but you can hear the clicks. Eventually, you figure out the whole combination. ### How the Chain Leads to Remote Code Execution On its own, a padding oracle is bad but not catastrophic. The real danger comes when you chain it with something else — in this case, a deserialization issue. Here's the rough flow: - Attacker exploits the padding oracle to forge a valid encrypted token - That token gets passed into a component that deserializes it - The deserialized object triggers code execution on the server - No login required. No credentials. Just a crafted request That's the nightmare scenario for anyone running internet-facing ASP.NET applications. But again — TantoSec was clear about this — the exploit only works when the app is configured in a specific, non-default way. Most installations won't be vulnerable to this exact chain. > "The gap between a theoretical vulnerability and a working exploit is often just one misconfiguration." — a sentiment that keeps security researchers up at night. ### Should You Panic? Probably Not. Progress patched the chain in July. There are no confirmed reports of this being exploited in the wild. So the sky isn't falling. But here's what you should actually do: - Verify you're running the latest version of Telerik UI for ASP.NET AJAX - Double-check any custom configurations that deviate from defaults - Review your deserialization handling — this is where a lot of modern exploits live - If you can't patch immediately, consider putting a WAF in front of affected endpoints If you're a developer or sysadmin, this is a good reminder that security isn't just about one bug. It's about how bugs interact. A padding oracle alone might be a moderate finding. Chain it with deserialization, and suddenly you're looking at critical severity. ### The Bigger Lesson Here Chained exploits are the new normal. Attackers don't care about individual CVEs — they care about paths. If one weakness opens a door and another weakness lets them walk through it, that's all they need. So when you see a patch release, don't just skim the notes. Ask yourself: what could this bug be chained with? What else in my stack might turn a small leak into a full breach? That mindset — thinking in chains, not checkboxes — is what separates reactive security from proactive defense. And in 2025, proactive is the only kind that actually works.