CVE-2017-11317

Critical9.8Published on August 23, 2017

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Apr 11, 2022
US federal agencies must remediate it by May 2, 2022 (BOD 22-01)
First attack observed 1030 days after disclosure

Apply updates per vendor instructions.

Source: CISA KEV · Mar 5, 2026 Oct 7, 2025 Nov 25, 2024 Nov 20, 2024 Nov 7, 2024 Jun 15, 2024

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-326, CWE-326

Vendorstelerik

Affected products

Vendors	Product	Versions
telerik	ui for asp.net ajax	<= 2016.3.1027

Vulnerabilities

Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE

Public Telerik RadAsyncUpload exploit chains AES padding oracle to unauthenticated RCE. Learn affected versions, conditions, CVEs and fix in 2026.2.708.

Sep 7, 202615:126 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE