Act
active
Telerik UI Padding-Oracle Chained to Unauthenticated RCE — PoC Public
- Engineer — Act: A working unauthenticated RCE exploit chain against Telerik UI for ASP.NET AJAX is now public; apply the July Progress patch immediately and audit whether any deployments use the affected non-default AES-CBC configuration that enables the oracle.
- SOC/IR — Plan: No confirmed wild exploitation or published IOCs yet, but the public PoC warrants building detections for anomalous HTTP requests targeting Telerik AJAX endpoints — prepare Sigma/SPL rules now so you’re ready if exploitation picks up.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.