Preliminary research

From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX

Marcio Almeida · Tanto Security · 7 September 2026

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Examines unauthenticated encryption and inconsistent validation across Telerik upload and postback paths. The case combines established cryptographic and deserialization techniques, explains nondefault deployment prerequisites, and shows why uniform error text alone is insufficient.

Record

Researcher

Marcio Almeida

Published by

Tanto Security

Date

7 September 2026

Topic

Server

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Exploiting padding oracles with fixed IVs
• Telerik research artifacts

Tags

• crypto
• deserialization
• aspnet
• attack-chain
• owasp-a02-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Marcio Almeida, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 18 September 2026.