URL has been copied successfully!
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE, Public Exploit Released
URL has been copied successfully!

Collecting Cyber-News from over 60 sources

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE, Public Exploit Released


Tags: , , , ,

A TantoSec proof-of-concept turns an AES-CBC “padding oracle” in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution, but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild.Security firm TantoSec has published a working exploit chain targeting vulnerabilities

First seen on thehackernews.com

Jump to article: thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html

Loading

Share via Email
Share on Facebook
Tweet on X (Twitter)
Share on Whatsapp
Share on LinkedIn
Share on Xing
Copy link

also interesting:

  1. Oracle-Lücke birgt Gefahr für RCE-Attacken
  2. Oracle OIM zero”‘day: Pre”‘auth RCE forces rapid patching across enterprises
  3. Oracle OIM zero”‘day: Pre”‘auth RCE forces rapid patching across enterprises
  4. Hackers Actively Exploit Critical WebLogic RCE Vulnerabilities in Ongoing Attacks