RadAsyncUpload Padding Oracle Vulnerability in Telerik UI for AJAX (CVE-2026-13182)

In Progress Telerik UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers. The vulnerability can be exploited remotely without authentication and does not require knowledge of the encryption key. Affected versions: - 2010.1.309 - 2026.2.519 We recommend updating to: 2026.2.708. CVSS 7.5 · our assessment: this_week Reference: https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-padding-oracle-cve-2026-13182 Details: https://vuln.today/cve/CVE-2026-13182