CVE-2019-18935
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2021 - Software and Data Integrity Failures
ASVS 5.0
V10 - Malicious Code Integrity verification, supply chain security
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Critical risk (CVSS 9.8, EPSS 93.6%). Telerik UI is embedded in thousands of .NET web applications, including US government systems. FBI and CISA issued joint advisories after APT actors exploited this to compromise federal agency networks in 2020. |
| Exploit ScenarioDerived | An attacker identifies a web application using Telerik UI, extracts or brute-forces the encryption key (often unchanged from defaults), then sends encrypted serialized .NET payloads to the RadAsyncUpload handler. The server deserializes the payload, executing OS commands that provide a web shell for persistent access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Progress Telerik UI for ASP.NET AJAX contains a .NET deserialization vulnerability in RadAsyncUpload that allows unauthenticated remote code execution when encryption keys are known, exploited by APT groups and ransomware operators.
Earlier versions of this analysis (1)
A .NET deserialization vulnerability in Telerik UI's RadAsyncUpload handler enables remote code execution. Exploitable when encryption keys are known through CVE-2017-11317, CVE-2017-11357, or default key configurations.
RemediationAI
Update Telerik UI to 2020.1.114+. Change default encryption keys to unique, random values. Implement .NET serialization binders to restrict deserializable types. Monitor for web shells in Telerik upload directories.
Affected ProductsAI
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-502 deserialization flaw exists in the RadAsyncUpload handler's processing of serialized .NET objects. The handler uses encryption to protect upload parameters, but if the key is known (via prior CVEs or default configurations), an attacker can craft encrypted payloads containing malicious serialized objects for code execution.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
Executive ViewAI
Organizations using Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 face critical risk from CVE-2019-18935, a insecure deserialization vulnerability rated CVSS 9.8. Insecure deserialization could allow attackers to execute arbitrary code by providing crafted serialized data. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict deserialization endpoints; (2) Implement integrity checks on serialized data; (3) Use type-safe alternatives.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.