Preliminary research

From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX

Marcio Almeida · Tanto Security · 7 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Examines unauthenticated encryption and inconsistent validation across Telerik upload and postback paths. The case combines established cryptographic and deserialization techniques, explains nondefault deployment prerequisites, and shows why uniform error text alone is insufficient.

Record

Researcher

Marcio Almeida

Published by

Tanto Security

Date

7 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Earlier fixed-IV research (2019)
• Research code

Tags

• crypto
• deserialization
• aspnet
• attack-chain
• owasp-a02-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Marcio Almeida, first published at the original source. Preserved copies are kept so the citation survives its host.