Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild. Security firm TantoSec has published a working exploit chain targeting vulnerabilities

Fact: The article describes a TantoSec proof-of-concept that chains a padding oracle vulnerability in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution, exploitable only in specific non-default configurations and already patched by Progress in July, with no confirmed exploitation in the wild. Fact: This affects web applications that embed Telerik UI as a third-party component, making it a supply chain issue for any broader software stack that might later host or integrate AI services. RealGround analysis: Organizations building or hosting AI-enabled applications on affected ASP.NET stacks should treat vulnerable UI components as part of their AI supply chain and ensure dependency inventories, SBOMs, and patch management cover these libraries before layering AI agents on top. RealGround analysis: Reviewing and hardening third-party components used in AI application delivery reduces the risk that non-AI RCE bugs become pivot points to compromise AI systems, models, or sensitive data handled by those systems.