Telerik UI Padding-Oracle Chained to Unauthenticated RCE — PoC Public

Mon, 07 Sep 2026 16:27:04 +0000

Engineer — Act: A working unauthenticated RCE exploit chain against Telerik UI for ASP.NET AJAX is now public; apply the July Progress patch immediately and audit whether any deployments use the affected non-default AES-CBC configuration that enables the oracle.
SOC/IR — Plan: No confirmed wild exploitation or published IOCs yet, but the public PoC warrants building detections for anomalous HTTP requests targeting Telerik AJAX endpoints — prepare Sigma/SPL rules now so you’re ready if exploitation picks up.
Leader — Skip

Padding-Oracle on CuraSec