importantSYS.SOURCE: The Hacker News• 2026-09-07T16:50:14+05:30

Telerik UI Padding-Oracle Vulnerability Exploited for Unauthenticated Remote Code Execution

#vulnerability #remote code execution #web security #exploit #cryptography

A public exploit has been released for a padding-oracle vulnerability in Telerik UI for ASP.NET AJAX, enabling unauthenticated remote code execution under specific non-default configurations. The vulnerability was patched by Progress in July 2026, but the exploit's release highlights ongoing risks for affected systems.

A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild.

Security firm TantoSec has published a working exploit chain targeting vulnerabilities

Read original article

*** END OF TRANSMISSION ***

> ANTICIPATED FEATURES AND RELEASES FROM APPLE'S UPCOMING PRODUCT LAUNCH > MICROSOFT 365 EXECUTIVE TARGETED BY VISHING AND TOKEN THEFT ATTACKS > BING WALLPAPER ADVERTISEMENTS FOR HARRY POTTER AND FANTASTIC BEASTS BOX SET EMERGE IN USER INTERFACE > BILL GATES DOCUMENTS USABILITY CHALLENGES WITH WINDOWS MOVIEMAKER INSTALLATION PROCESS > WEEKLY CYBERSECURITY UPDATE: CHROME ZERO-DAY, ROUTER EXPLOITS, AND SUPPLY CHAIN THREATS > BZIP3: ENHANCED COMPRESSION ALGORITHM WITH ADVANCED ENTROPY CODING > COGNITIVE REVITALIZATION: A DEVELOPER'S APPROACH TO INTELLECTUAL ENGAGEMENT DURING VACATIONS > INNOVATIVE URINAL TECHNOLOGY FOR SPLASH REDUCTION: 2025 RESEARCH > EU SMARTPHONE REPAIRABILITY REGULATIONS FREQUENTLY VIOLATED BY MANUFACTURERS > CLOUD SECURITY CHECKLISTS FAIL TO ADDRESS PROVIDER-SPECIFIC MISCONFIGURATIONS> ANTICIPATED FEATURES AND RELEASES FROM APPLE'S UPCOMING PRODUCT LAUNCH > MICROSOFT 365 EXECUTIVE TARGETED BY VISHING AND TOKEN THEFT ATTACKS > BING WALLPAPER ADVERTISEMENTS FOR HARRY POTTER AND FANTASTIC BEASTS BOX SET EMERGE IN USER INTERFACE > BILL GATES DOCUMENTS USABILITY CHALLENGES WITH WINDOWS MOVIEMAKER INSTALLATION PROCESS > WEEKLY CYBERSECURITY UPDATE: CHROME ZERO-DAY, ROUTER EXPLOITS, AND SUPPLY CHAIN THREATS > BZIP3: ENHANCED COMPRESSION ALGORITHM WITH ADVANCED ENTROPY CODING > COGNITIVE REVITALIZATION: A DEVELOPER'S APPROACH TO INTELLECTUAL ENGAGEMENT DURING VACATIONS > INNOVATIVE URINAL TECHNOLOGY FOR SPLASH REDUCTION: 2025 RESEARCH > EU SMARTPHONE REPAIRABILITY REGULATIONS FREQUENTLY VIOLATED BY MANUFACTURERS > CLOUD SECURITY CHECKLISTS FAIL TO ADDRESS PROVIDER-SPECIFIC MISCONFIGURATIONS