Skip to content
RCE Vulnerabilities Discovered in Telerik UI for ASP.NET AJAX

RCE Vulnerabilities Discovered in Telerik UI for ASP.NET AJAX

First seen 27 Oct 2026, 16:16 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 27, 2026 at 17:18 UTC
  • •Two critical vulnerabilities (CVE-2026-18672, CVE-2026-19219) in Telerik UI for ASP.NET AJAX.
  • •Exploitation allows unauthenticated remote code execution via file read and upload.
  • •Users must upgrade to version 2026.3.812 or later to mitigate risks.

Tanto Security has identified two vulnerabilities in Telerik UI for ASP.NET AJAX, allowing unauthenticated remote code execution (RCE). The first vulnerability (CVE-2026-18672) enables arbitrary file read through RadImageEditor, while the second (CVE-2026-19219) allows unrestricted file uploads via RadEditor. Exploitation requires specific configurations in web.config, such as a static machineKey or Telerik.Web.UI.DialogParametersEncryptionKey. Users are advised to upgrade to version 2026.3.812 or later to mitigate these risks. The vulnerabilities were disclosed on October 27, 2026, and are due to the potential for. Proof-of-concept code is publicly available, increasing the urgency for affected users to act. The vulnerabilities affect versions 2011.2.712 through 2026.2.708 inclusive.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-07-22
CVE-2026-13187 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-22
CVE-2026-13188 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-22
CVE-2026-13183 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-22
CVE-2026-13181 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-22
CVE-2026-13192 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-22
CVE-2026-13182 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-22
CVE-2026-13189 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-22
CVE-2026-14865 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-22
CVE-2026-13184 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-22
CVE-2026-14932 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (5)

Following this threat?

Track CVE-2026-13181 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 3

Common questions

Which versions of Telerik are affected?
Versions 2011.2.712 through 2026.2.708 are affected by these vulnerabilities.
What should I do to protect my systems?
Upgrade to version 2026.3.812 or later to mitigate the vulnerabilities.
Is there a proof-of-concept available?
Yes, proof-of-concept code for the vulnerabilities is publicly available.