TantoSec published proof-of-concept exploit code on September 7 that chains a Telerik UI for ASP.NET AJAX padding oracle vulnerability into unauthenticated remote code execution. The exploit release, noting that Progress Software patched the vulnerability chain in July—two months before the public PoC became available. No confirmed reports of exploitation in the wild have surfaced.
The vulnerability affects only applications running Telerik UI in a specific non-default configuration. Organizations using affected configurations with outdated versions face risk of unauthenticated compromise now that working exploit code is publicly available.
TantoSec’s Padding Oracle to RCE Exploit Chain Targets Non-Default Telerik UI Configurations
The exploit begins with an AES-CBC padding oracle vulnerability in Telerik UI for ASP.NET AJAX. Padding oracle attacks allow attackers to decrypt encrypted data without knowing the encryption key by observing how the application responds to modified ciphertext. In this case, TantoSec demonstrated how to chain the decryption capability into full remote code execution.
The attack requires the target application to use a specific non-default Telerik UI configuration. Progress Software’s July patch addressed the vulnerability chain, but organizations that have not applied the update remain exposed. The two-month gap between patch availability and public exploit release provided a window for defenders to update before attacker tooling became widely available.
Why Public PoC Exploit Release Two Months Post-Patch Increases Risk for Unpatched Systems
Vulnerability disclosures typically follow a timeline: private notification to the vendor, patch development, public advisory, and eventual proof-of-concept release. The two-month delay between Progress Software’s July patch and TantoSec’s September exploit publication gave organizations time to test and deploy the fix before exploitation difficulty dropped.
Public PoC availability transforms a vulnerability from a theoretical risk requiring custom exploit development into an accessible attack that anyone with basic technical skills can deploy. Organizations that ignored the July patch advisory now face substantially higher risk because attackers no longer need specialized expertise to exploit the flaw.
The non-default configuration requirement limits exposure compared to vulnerabilities affecting default installations, but it does not eliminate risk. Custom configurations, legacy deployments, and applications built from outdated templates may use the vulnerable setup. Organizations cannot assume they are safe without explicitly verifying their Telerik UI configuration and patch level.
Organizations Using Telerik UI Must Verify July 2026 Patch Status and Configuration Settings
Security teams should audit all applications using Telerik UI for ASP.NET AJAX to confirm they are running the July or later patched version. The patch addresses the padding oracle vulnerability that enables the exploit chain. Organizations that deploy monthly security updates should already have the fix, but applications with delayed patching schedules or those maintained by third-party developers may still run vulnerable code.
Configuration audits should identify any applications using the non-default settings that increase exposure to the attack. Even with the patch applied, organizations should evaluate whether the specific configuration serves a necessary purpose or represents legacy settings that can be changed to reduce attack surface.
The padding oracle to RCE chain demonstrates a common pattern in web application vulnerabilities: seemingly low-severity information disclosure flaws can enable critical impact when chained with additional attack steps. Padding oracle vulnerabilities often receive lower severity ratings in isolation because they only decrypt data. TantoSec’s research shows how that decryption capability becomes a building block for unauthenticated code execution in specific application contexts.
Organizations should not wait for public exploit code before patching. The July advisory from Progress Software indicated the vulnerability enabled unauthorized access, which should have triggered emergency patching regardless of public exploit availability. The September PoC release primarily affects organizations that deprioritized the July patch or lacked processes to identify which applications used the vulnerable Telerik component.
Web application component libraries like Telerik UI create transitive risk: vulnerabilities in the library affect every application that incorporates it. Organizations often struggle to maintain accurate inventories of which applications use which third-party components, leading to incomplete patching when vendor advisories are released. Asset management systems should track application dependencies at the component level to enable rapid response when library vulnerabilities are disclosed.
