Loading story…
Progress Software disclosed two vulnerabilities affecting Telerik UI for ASP.NET AJAX releases prior to 2026.3.812: CVE-2026-18672, a path traversal flaw in the Telerik Web Forms RadImageEditor component, and CVE-2026-19219, an UploadPaths tampering issue in the Telerik Web Forms DialogHandler component. The Canadian Centre for Cyber Security published advisory AV26-875 covering the issues.
Organizations using affected Telerik UI for ASP.NET AJAX deployments should identify exposed Web Forms applications, review Progress Software's vendor advisories, and upgrade to version 2026.3.812 or later when available. Administrators should prioritize internet-facing applications and assess whether vulnerable image-editing or file-dialog functionality has been exposed or misused.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-875 identifying CVE-2026-18672, a path traversal flaw in Telerik Web Forms RadImageEditor, and CVE-2026-19219, an UploadPaths tampering flaw in Telerik Web Forms DialogHandler. Telerik UI for ASP.NET AJAX versions before 2026.3.812 are affected, and users were advised to apply available updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcetelerik.com
Open sourcetelerik.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A four-CVE chain in Telerik UI for ASP.NET AJAX's `RadAsyncUpload` component can allow unauthenticated remote code execution in affected ASP.NET WebForms applications. **CVE-2026-13182** exposes an AES-CBC padding oracle in encrypted client-state handling, enabling recovery and forgery of configuration data; the reported chain also uses decrypt-versus-parse behavior, a predictable HMAC key, and a type-name deserialization gadget. Forged configuration can permit DLL uploads, after which unsafe upload-metadata type resolution in **CVE-2026-13181** can load a malicious mixed-mode DLL and execute code in the IIS worker process. The full chain includes CVE-2026-13181 through CVE-2026-13184. Affected Telerik UI for ASP.NET AJAX releases range from `2010.1.309` through `2026.2.519`; Progress Software remediated the issues in version `2026.2.708`. Exploitation requires an exposed vulnerable `RadAsyncUpload` page whose `FileUploaded` handler reads `UploadResult`, plus an explicitly configured non-default `Telerik.AsyncUpload.ConfigurationEncryptionKey`. Organizations should upgrade immediately, review RadAsyncUpload pages and event handlers, and investigate unusual IIS child processes, temporary DLLs, and unexpected ASPX files.
Sep 7, 2026
Progress released security updates for **Sitefinity CMS**, **Sitefinity Insight**, and **Kemp LoadMaster**, with the most urgent attention on multiple severe Sitefinity web-service vulnerabilities affecting versions from **8.0 through 15.4**. The Canadian Centre for Cyber Security flagged the vendor advisories and urged administrators to review Progress bulletins and apply patches. Among the Sitefinity issues, **`CVE-2026-7312`** carries a **CVSS 10.0** rating and can let an unauthenticated attacker obtain plaintext credentials used for **Sitefinity Insight** connections when that integration is enabled in a non-default configuration, while **`CVE-2026-7198`** is rated **CVSS 9.8** and allows unauthenticated access to restricted content in affected **15.4** deployments. Additional Sitefinity flaws include **`CVE-2026-7201`**, an authorization bypass that can let an authenticated low-privilege user modify other users' account properties, and **`CVE-2026-7313`**, which exposes Insight credentials to authenticated back-end users under specific configurations. Progress published patched releases including **15.4.8630**, **15.3.8531**, **15.2.8441**, **15.1.8335**, **15.0.8234**, **14.4.8152**, and **13.3.7652**, and warned that delaying remediation leaves OData and related web services open to unauthorized exploitation. The broader advisory set also includes two vulnerabilities affecting **Progress Kemp LoadMaster**.
Jun 29, 2026
**CVE-2024-46938** is an order-of-operations flaw affecting Sitecore CMS 8.x through 10.x that allows unauthenticated attackers to read arbitrary local files when they know, or can infer, the product’s absolute installation path. Attackers can use the issue to retrieve sensitive files such as `web.config` and Sitecore backup files, exposing application secrets. Disclosed ASP.NET machine keys or Telerik encryption keys can be leveraged for .NET ViewState deserialization and ultimately remote code execution. Sitecore addressed the issue in August 2024 in Security Bulletin **SC2024-001-619349**, but internet-exposed deployments may remain susceptible if unpatched; organizations should apply the vendor update and assess exposed instances for secret disclosure and potential compromise.
Sep 3, 2026