CVE-2026-13182

High7.5Published on July 22, 2026

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.

CVSS score7.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness type (CWE)CWE-209

Vendorsprogress

Affected products

Vendors	Product	Versions
progress	telerik ui for asp.net ajax	< 2026.2.708

Vulnerabilities

Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE

Public Telerik RadAsyncUpload exploit chains AES padding oracle to unauthenticated RCE. Learn affected versions, conditions, CVEs and fix in 2026.2.708.

Sep 7, 202615:126 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE