EUVD-2026-47687
GHSA-h9g3-2g32-4pqc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable and unauthenticated (AV:N/PR:N); AC:H because an oracle attack needs many iterative probes and observable response differences; confidentiality-only disclosure of protected metadata (C:H, I:N, A:N).
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.
AnalysisAI
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must expose the Telerik RadAsyncUpload control and its async-upload HTTP handler to the attacker, and be running a build prior to v2026.2.708. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and no integrity or availability impact - consistent with an information-disclosure oracle rather than direct code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker with no credentials locates a public ASP.NET page that uses RadAsyncUpload and repeatedly submits mutated encrypted client-state tokens to the upload handler. By observing whether the server responds with a decrypt failure versus an invalid-JSON parse failure, the attacker uses the oracle to progressively recover the protected metadata inside the token. … |
| Remediation | Upgrade to Telerik UI for ASP.NET AJAX v2026.2.708 or later (Vendor-released patch: v2026.2.708), which removes the distinguishable-error oracle in RadAsyncUpload client-state processing; then rebuild and redeploy all dependent ASP.NET applications and rotate the Telerik encryption keys/machineKey used to protect upload state since an oracle may have exposed protected values. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all web applications using Progress Telerik UI for ASP.NET AJAX versions before 2026.2.708, particularly those utilizing RadAsyncUpload controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistenc
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today