Loading story…
AhnLab Security Intelligence Center identified two attacks exploiting CVE-2019-18935, a remote-code-execution vulnerability affecting unpatched Telerik UI for ASP.NET AJAX servers. In one incident, the attacker exploited the exposed Telerik component to launch a reverse shell, attempted privilege escalation, and installed a web shell for persistent remote access.
A separate intrusion involved execution of a scanner after exploitation of the same Telerik UI flaw, indicating attackers are using the legacy vulnerability for both post-compromise access and environment reconnaissance. Organizations operating Telerik UI for ASP.NET AJAX should identify and remediate internet-exposed, unpatched deployments and investigate servers for reverse-shell activity, unauthorized web shells, privilege-escalation attempts, and unexpected scanner execution.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
AhnLab Security Intelligence Center identified two attacks targeting unpatched Telerik UI for ASP.NET AJAX servers via CVE-2019-18935, a remote-code-execution vulnerability. In one incident, the attacker obtained access with a reverse shell, attempted privilege escalation, and installed a web shell.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A four-CVE chain in Telerik UI for ASP.NET AJAX's `RadAsyncUpload` component can allow unauthenticated remote code execution in affected ASP.NET WebForms applications. **CVE-2026-13182** exposes an AES-CBC padding oracle in encrypted client-state handling, enabling recovery and forgery of configuration data; the reported chain also uses decrypt-versus-parse behavior, a predictable HMAC key, and a type-name deserialization gadget. Forged configuration can permit DLL uploads, after which unsafe upload-metadata type resolution in **CVE-2026-13181** can load a malicious mixed-mode DLL and execute code in the IIS worker process. The full chain includes CVE-2026-13181 through CVE-2026-13184. Affected Telerik UI for ASP.NET AJAX releases range from `2010.1.309` through `2026.2.519`; Progress Software remediated the issues in version `2026.2.708`. Exploitation requires an exposed vulnerable `RadAsyncUpload` page whose `FileUploaded` handler reads `UploadResult`, plus an explicitly configured non-default `Telerik.AsyncUpload.ConfigurationEncryptionKey`. Organizations should upgrade immediately, review RadAsyncUpload pages and event handlers, and investigate unusual IIS child processes, temporary DLLs, and unexpected ASPX files.
Sep 7, 2026
Progress Software disclosed two vulnerabilities affecting Telerik UI for ASP.NET AJAX releases prior to `2026.3.812`: **CVE-2026-18672**, a path traversal flaw in the Telerik Web Forms `RadImageEditor` component, and **CVE-2026-19219**, an `UploadPaths` tampering issue in the Telerik Web Forms `DialogHandler` component. The Canadian Centre for Cyber Security published advisory `AV26-875` covering the issues. Organizations using affected Telerik UI for ASP.NET AJAX deployments should identify exposed Web Forms applications, review Progress Software's vendor advisories, and upgrade to version `2026.3.812` or later when available. Administrators should prioritize internet-facing applications and assess whether vulnerable image-editing or file-dialog functionality has been exposed or misused.
Sep 4, 2026
**CVE-2024-46938** is an order-of-operations flaw affecting Sitecore CMS 8.x through 10.x that allows unauthenticated attackers to read arbitrary local files when they know, or can infer, the product’s absolute installation path. Attackers can use the issue to retrieve sensitive files such as `web.config` and Sitecore backup files, exposing application secrets. Disclosed ASP.NET machine keys or Telerik encryption keys can be leveraged for .NET ViewState deserialization and ultimately remote code execution. Sitecore addressed the issue in August 2024 in Security Bulletin **SC2024-001-619349**, but internet-exposed deployments may remain susceptible if unpatched; organizations should apply the vendor update and assess exposed instances for secret disclosure and potential compromise.
Sep 3, 2026