Public exploit turns Telerik padding-oracle flaw into full server takeover

Key points

• TantoSec has released a working exploit chain against Telerik UI for ASP.NET AJAX, a widely used web component library.
• The attack abuses a padding oracle, a cryptographic weakness that lets attackers decrypt and forge encrypted data one byte at a time.
• Only apps running a specific non-default configuration are vulnerable, and Progress Software shipped a fix in July.
• No exploitation in the wild has been confirmed at time of writing.
• Admins running Telerik UI should confirm they are on the July 2026 build or later and audit their web.config settings.

A security company called TantoSec has published a fully working attack that turns a cryptography bug in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution. No login required. An attacker on the open internet can end up running their own commands on the affected web server.

Telerik UI for ASP.NET AJAX is a library of ready-made web components (buttons, grids, file uploaders) that thousands of business apps quietly rely on. Progress Software makes it. If you've ever used an insurance portal or a government form that felt oddly familiar across different sites, there's a decent chance Telerik was under the hood.

Progress patched the underlying chain in July. The Hacker News reported the public proof-of-concept this week. We covered a related class of cryptographic abuse back in May, when hard-coded ASP.NET machine keys in a Japanese LMS were used to forge ViewState payloads and drop Cobalt Strike; that attack required no patch because it relied on a platform design choice, not a vendor bug. This one at least has a fix available.

How does the attack actually work?

Padding oracles are a classic flaw in how some systems handle encrypted data. When the server decrypts a value and the padding at the end is wrong, it reacts differently than when the padding is correct. An attacker sends thousands of tweaked messages and, byte by byte, works out what the plaintext says, or forges new encrypted data of their choosing.

TantoSec can hand-craft encrypted parameters that Telerik accepts as legitimate. From there, the chain pivots to file upload and code execution features inside the component, and the server runs whatever the attacker wants.

The failure mode is familiar: a cryptographic side channel that looks academic on paper, weaponised into unauthenticated RCE once someone puts in a weekend.

Who is actually at risk?

Only sites running Telerik UI for ASP.NET AJAX in a specific non-default configuration are exposed. That's the good news. The less good news is that plenty of long-lived enterprise apps were configured years ago by people who've since left, and nobody's looked at the settings since.

What should teams do this week?

Confirm the version first. Progress shipped the fix in a July release, so anything older is a candidate for exploitation now that working code is public. Then check the configuration: the vulnerable path only opens in a specific non-default setup, and your web.config is the place to look.

Can't patch immediately? Put the app behind a web application firewall rule that blocks the malformed encrypted payloads the padding-oracle attack sends in bulk. Stopgap, not a fix.

If anyone gets popped by this, the post-mortem will note that the patch was available for months before the exploit dropped.

Should ordinary customers worry?

Not directly, and not yet. There are no confirmed cases of anyone exploiting this against real companies. But if a business you deal with runs a customer portal built on older Telerik components and gets breached in the coming weeks, this is a plausible route in. Watch for breach notification emails and treat any password reset prompt with the usual care: go to the site yourself rather than clicking the link in the email.

Public PoC plus a four-month-old patch equals a scanning wave by the weekend. Get on the July build.