What is the CVSS score of EUVD-2026-47686?

EUVD-2026-47686 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Telerik UI are affected by EUVD-2026-47686?

Progress Telerik UI for ASP.NET AJAX before v2026.2.708 contains an unauthenticated remote code execution vulnerability affecting the RadAsyncUpload handler.. A patch is available.

How to fix or mitigate EUVD-2026-47686?

Within 24 hours, audit all systems running Progress Telerik UI for ASP.NET AJAX to identify those with internet-facing RadAsyncUpload endpoints and determine organizational exposure. Within 7 days, implement interim mitigations including disabling the RadAsyncUpload component where feasible, restricting the RAU handler endpoint via firewall rules or VPN access control, and deploying Web Application Firewall rules to inspect and block requests with suspicious AsyncUploadTypeName parameter values. Within 30 days, establish direct contact with Progress Software to confirm patch availability for v2026.2.708 or later and develop a testing and deployment plan; evaluate alternative file-upload solutions or component replacements in parallel as contingency.

Telerik UI EUVD-2026-47686

| CVE-2026-13181 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-07-22 ProgressSoftware

GHSA-78c9-2h53-ghvw

RCE Telerik Ui For Asp Net Ajax Progress Software

8.1

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote unauthenticated RAU handler gives AV:N/PR:N/UI:N, but forging valid/encrypted upload metadata for type resolution warrants AC:H; successful type instantiation yields full C:H/I:H/A:H RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:30 vuln.today

CVE Published

Jul 22, 2026 - 13:33 cve.org

HIGH 8.1

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments.

AnalysisAI

Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metadata so that the AsyncUploadTypeName value drives unsafe, attacker-controlled type resolution, letting them instantiate arbitrary types and run code on the hosting server. The flaw sits in the RadAsyncUpload (RAU) handler, historically an unauthenticated endpoint (CVSS PR:N), and carries an 8.1 High score tempered by AC:H, reflecting the crafting/forgery effort required. At time of analysis there is no public exploit identified and it is not in CISA KEV, though the same component has a long history of weaponized deserialization bugs.

Technical ContextAI

Telerik UI for ASP.NET AJAX is a widely used commercial UI control suite for .NET web applications; the affected surface is the RadAsyncUpload component and its RAU handler, which processes serialized upload metadata submitted by the client. The root cause is CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, i.e. unsafe reflection): the AsyncUploadTypeName field, which should identify a trusted server-side type, is derived from attacker-influenced metadata and used to resolve and instantiate a .NET type. Because type resolution is driven by untrusted input, an attacker can steer the framework into loading and constructing a type of their choosing, which in .NET can cascade into code execution. This mirrors the well-known class of RadAsyncUpload deserialization/type-confusion issues (e.g. CVE-2019-18935) that plagued this same handler.

RemediationAI

Vendor-released patch: v2026.2.708 - upgrade Telerik UI for ASP.NET AJAX to v2026.2.708 or later, which is the definitive fix, and rebuild/redeploy affected applications with the updated Telerik.Web.UI assembly. If immediate patching is not possible, reduce exposure by disabling or removing the RadAsyncUpload component where unused and by restricting or blocking external access to the Telerik.Web.UI.WebResource.axd / RadAsyncUpload (RAU) handler endpoint at the WAF or reverse proxy, accepting that this breaks async upload functionality for any pages that rely on it. Ensure the AsyncUpload configuration encryption keys (Telerik encryption/machine keys) are set to strong, non-default values as historically recommended for this handler, and monitor upload requests for anomalous type metadata. Follow the exact guidance in the vendor advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-asyncuploadtypename-deserialization-CVE-2026-13181.