CVE-2026-13181: Telerik UI for AJAX RCE Vulnerability

CVE-2026-13181 Overview

CVE-2026-13181 is a remote code execution vulnerability in Progress Telerik UI for AJAX versions prior to v2026.2.708. The flaw allows attackers to forge upload metadata that influences AsyncUploadTypeName processing, triggering unsafe attacker-controlled type resolution. This is categorized as an Unsafe Reflection weakness [CWE-470], where the application resolves types from untrusted input. Successful exploitation leads to arbitrary code execution on the affected web server. The vulnerability is network-exploitable and requires no authentication or user interaction.

Critical Impact
Unauthenticated attackers can achieve remote code execution on web servers running Telerik UI for AJAX by forging upload metadata to control server-side type resolution.

Affected Products

Progress Telerik UI for AJAX prior to v2026.2.708
ASP.NET web applications embedding the vulnerable RadAsyncUpload control
Deployments exposing the Telerik.Web.UI.WebResource.axd handler

Discovery Timeline

2026-07-22 - CVE-2026-13181 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13181

Vulnerability Analysis

The vulnerability resides in the RadAsyncUpload component of Telerik UI for AJAX. The component processes an AsyncUploadTypeName value supplied through upload metadata during file upload requests. When this value is attacker-controlled, the server performs type resolution against arbitrary .NET types. Unsafe reflection over untrusted type names allows attackers to instantiate dangerous types and trigger deserialization gadgets that lead to code execution in the worker process.

The attack complexity is rated High, which reflects conditions such as valid cryptographic keys, timing, or configuration state required to craft the forged metadata. However, successful exploitation results in full compromise of confidentiality, integrity, and availability on the target host.

Root Cause

The root cause is improper validation of the AsyncUploadTypeName parameter passed within upload metadata. The component trusts the client-supplied type identifier and passes it to reflection APIs without restricting it to a safe allowlist. This pattern maps to [CWE-470] Use of Externally-Controlled Input to Select Classes or Code, commonly called Unsafe Reflection.

Attack Vector

An attacker sends a crafted multipart upload request to the Telerik async upload handler. The request includes forged metadata that sets AsyncUploadTypeName to a gadget class chosen by the attacker. The server resolves and instantiates the specified type during upload processing, triggering deserialization or constructor logic that executes attacker-controlled code. No authentication is required, and the attack traverses the network directly to any internet-facing web application embedding the vulnerable control. Refer to the Telerik Security Advisory for CVE-2026-13181 for vendor technical details.

Detection Methods for CVE-2026-13181

Indicators of Compromise

POST requests to Telerik.Web.UI.WebResource.axd or Telerik.Web.UI.SpellCheckHandler.axd endpoints containing type=rau parameters from unexpected sources
Multipart upload payloads containing non-standard AsyncUploadTypeName values referencing .NET framework classes outside the Telerik namespace
New child processes such as cmd.exe, powershell.exe, or w3wp.exe spawning shells shortly after upload handler activity
Unexpected files written to web application temporary upload directories

Detection Strategies

Inspect IIS and application logs for requests to Telerik async upload endpoints and correlate with process creation events on the host
Alert on w3wp.exe spawning command interpreters or writing executable files to disk
Deploy web application firewall rules that inspect RadAsyncUpload metadata fields for unexpected type names
Baseline legitimate AsyncUploadTypeName values used by the application and flag deviations

Monitoring Recommendations

Continuously monitor outbound connections from IIS worker processes to unfamiliar destinations that may indicate a reverse shell
Track file writes to App_Data, temporary upload folders, and web-accessible directories
Enable IIS Failed Request Tracing on Telerik handlers to capture full request bodies during triage

How to Mitigate CVE-2026-13181

Immediate Actions Required

Upgrade Telerik UI for AJAX to v2026.2.708 or later on all production and non-production systems
Inventory all ASP.NET applications for embedded Telerik.Web.UI.dll assemblies, including third-party products that bundle the library
Rotate any Telerik.Web.UI.RadAsyncUpload encryption keys and machine keys that may have been exposed
Restrict network access to Telerik upload handlers where they are not required for business function

Patch Information

Progress has released Telerik UI for AJAX v2026.2.708 which addresses the unsafe type resolution in AsyncUploadTypeName processing. Consult the Telerik Security Advisory for CVE-2026-13181 for upgrade instructions and configuration guidance.

Workarounds

Disable the RadAsyncUpload control in applications that do not require file upload functionality
Configure a strict allowlist of permitted upload target types through the AsyncUploadConfiguration where supported
Deploy WAF signatures that block requests containing suspicious AsyncUploadTypeName values referencing serialization gadget classes
Remove the Telerik HTTP handler registrations from web.config when the upload feature is not in use

bash

# Configuration example: remove Telerik async upload handler from web.config
# Edit the <system.webServer><handlers> section and remove or comment:
# <add name="Telerik_Web_UI_WebResource_axd" ... />
# Then recycle the IIS application pool:
appcmd recycle apppool /apppool.name:"YourAppPool"