CVE-2019-18935
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Nov 3, 2021
- US federal agencies must remediate it by May 3, 2022 (BOD 22-01)
- First attack observed 147 days after disclosure
- Confirmed by sensors, not only by reports
- Used in ransomware campaigns
Apply updates per vendor instructions.
Source: CISA KEV · Sep 28, 2026 Sep 28, 2026 Sep 27, 2026 Sep 25, 2026 Sep 17, 2026 Sep 15, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| telerik | ui for asp.net ajax | <= 2020.1.114 |
Related articles
Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE
Public Telerik RadAsyncUpload exploit chains AES padding oracle to unauthenticated RCE. Learn affected versions, conditions, CVEs and fix in 2026.2.708.
SPECTRE, the backdoor that disables EDRs: inside UAT-10147's arsenal
Recently, Cisco Talos published a two-part analysis of the Chinese-speaking group UAT-10147 , which is active against Windows and Linux web servers on a
This product uses the NVD API but is not endorsed or certified by the NVD.