CVE-2026-13184

High7.5Published on July 22, 2026

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.

CVSS score7.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness type (CWE)CWE-321

Vendorsprogress

Affected products

Vendors	Product	Versions
progress	telerik ui for asp.net ajax	< 2026.2.708

Vulnerabilities

Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE

Public Telerik RadAsyncUpload exploit chains AES padding oracle to unauthenticated RCE. Learn affected versions, conditions, CVEs and fix in 2026.2.708.

Sep 7, 202615:126 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Public Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE