Progress Telerik UI for AJAX RadAsyncUpload Type Resolution Vulnerability (CVE-2026-13181)

Vulnerability Overview Vulnerability Name: RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability (CVE-2026-13181) Description: In Progress Telerik UI for AJAX 2026.2.519 and earlier versions, forged upload metadata can affect the processing, triggering insecure attacker-controlled type resolution that may lead to Remote Code Execution (RCE). Impact: Potential for Remote Code Execution. Affected Versions Affected Versions: Progress Telerik UI for AJAX 2026.2.519 and earlier. Conditions: - The application uses . - The application has not been upgraded to the patched version. - The asynchronous upload handler is not disabled by setting the appSettings key to . Remediation Recommended Action: Upgrade to the latest version. Specific Versions: - Upgrade current versions to . Update Instructions: Follow the update guide for precise instructions. All customers with a Progress Telerik UI for AJAX license can access downloads here: Product Downloads Mitigation Measures If immediate upgrade is not possible: - For versions v2026.2.514 and earlier: - Scenario 1: If is used in , remove to fall back to using with AES + HMAC. - Scenario 2: If is not used, continue generating strong machine keys. - For versions v2026.2.708 and later: - Option 1: Continue using , which provides stronger protection (AES-GCM) than the . - Option 2: Remove and use the . Although less secure than GCM, it is useful in web farm environments and supports "auto-generated keys at runtime." Instructions for Generating Strong Machine Keys AES + HMAC Support: Generate strong machine keys via machine key configuration. Note that even strong custom keys will not prevent Oracle attacks. Manual Key Generation: Manually generate keys in IIS, using the same HMAC protection created by Autogenerate. Steps: 1. Open IIS > Select the site > Select Machine Key. 2. Verification method: Select HMACSHA256. 3. Auto-generate at runtime checkbox: Uncheck (very important). 4. In the right pane, click Generate Keys. 5. In the right pane, click Apply. 6. In the left pane, select Application Pools and recycle the relevant App Pool (very important). Additional Measures If RadAsyncUpload is not needed: Disable the handler by setting the key to in the section of . Notes Technical Support: If you have any questions or concerns, please open a new technical support case. Technical support is available to customers with an active support plan. Acknowledgments: Thanks to the researchers at TantoSec for their responsible disclosure and cooperation. External References CVE-2026-13181 (High) CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) Discovered by: Marcio Almeida of TantoSec

Goal Reached Thanks to every supporter — we hit 100%!

Progress Telerik UI for AJAX RadAsyncUpload Type Resolution Vulnerability (CVE-2026-13181)