> TritonInfoSec News
Home / Sep 08, 2026 / Story
0
#10 The Hacker News general September 07, 2026 at 11:20 UTC

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

By [email protected] (The Hacker News)

AI Summary

TantoSec released a working public exploit chain that leverages an AES-CBC padding oracle vulnerability in Telerik UI for ASP.NET AJAX to achieve unauthenticated remote code execution, though only against applications in a specific non-default configuration. Progress patched the vulnerability chain in July 2026, but the public PoC release substantially raises exploitation risk for organizations that have not yet applied the patch.

Read full article → https://thehackernews.com/2026/09/telerik-ui-paddi…

Relevance score: 78.0/100

# More from September 08

  1. 1
    Magento StyleSmuggler zero-day exploited to deploy Linux backdoor BleepingComputer
  2. 2
    Adobe Commerce Zero-Day Exploited to Backdoor Online Stores SecurityWeek
  3. 3
    Hackers exploit new MikroTik RouterOS flaws to hijack routers BleepingComputer
  4. 4
    Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication The Hacker News
  5. 5
    N-able patches max severity N-central flaw amid ongoing attacks BleepingComputer
  6. 6
    N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw The Hacker News
  7. 7
    BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations BleepingComputer
  8. 8
    Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits SecurityWeek
  9. 9
    Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts The Hacker News