- Progress Software says two Telerik UI for ASP.NET AJAX flaws, CVE-2026-18672 and CVE-2026-19219, can be chained by an unauthenticated attacker to run code on the server.
- Tanto Security says the second step needs a key in web.config that default installs do not have. Progress says the first flaw can expose that key.
- Progress says upgrading to 2026.3.812 or later is the only full fix. Teams should find every Telerik install, including vendor-built apps.
Checking the fix for one Telerik chain turned up another
Security teams often treat a patch as the end of a story. The latest Telerik bulletin shows why that habit is risky. Tanto Security reported an earlier remote code execution chain in Telerik UI for ASP.NET AJAX. It says it found this new one while checking whether Progress Software's fix for the first chain had worked.
Progress fixed the first chain in version 2026.2.708. The new chain is fixed in 2026.3.812. Tanto found a separate bug in a different control, not a flaw the earlier patch introduced. The lesson here is that a closed bug does not tell you the area around it is safe.
What Progress says is at risk
Progress Software, which owns Telerik, published a bulletin on two flaws: CVE-2026-18672 and CVE-2026-19219. It says an unauthenticated remote attacker can chain them to obtain application configuration secrets and then run code on the server.
The attacker's code would inherit the permissions of the account the web application runs under. Progress calls that account the application pool identity. It says the result could be full server compromise, stolen data or movement deeper into the hosting environment.
Progress lists versions 2026.2.708 and earlier as affected. Tanto, citing Progress, puts the start of that range at 2011.2.712. Progress also warns that an attack can proceed silently. The application shows no errors, and standard ASP.NET error logs hold no obvious sign of it.
How the chain works
The first flaw, CVE-2026-18672, sits in RadImageEditor, a control that edits images on the server. Progress describes it as a path traversal bug, which lets an attacker read files outside the folders meant for images. Tanto explains that the control passes its settings back and forth through a hidden field in the page. Nothing encrypts or signs that field, so a user can edit it before it returns.
On its own that is a leak. Tanto says the readable files include web.config, where site operators keep keys and other secrets.
The second flaw, CVE-2026-19219, is in RadEditor, Telerik's rich-text editor. Its file-browser dialogs receive a parameter blob that the server encrypts and authenticates. Tanto says it cannot be changed without the key. With the key, Progress says an attacker can influence server-side file operations, and Tanto describes this as an unrestricted file upload that leads to code execution.
There is a limit. Tanto says the second step needs a static machineKey or a DialogParametersEncryptionKey in web.config, and a default install has neither. But Progress says the first flaw can reveal any DialogParametersEncryptionKey an application has configured. The bulletin says key secrecy "cannot be relied on to fully stop this specific chain."
Why a 7.5 file-read score hides the real risk
Progress rates CVE-2026-18672 at 7.5 and CVE-2026-19219 at 8.1, both High. The 7.5 vector lists impact on confidentiality only. Read alone, it looks like a data leak.
This shows how scoring each bug alone can hide the combined result. The 8.1 score does reflect code execution. But no score covers the pair as one path. A file-read flaw becomes a code-execution flaw when the readable file holds the keys that protect the next step. Tanto says Progress recommends operators set those keys up by hand. Here, the file that holds them is the one the first flaw can read.
What leaders should ask their teams
First, do we run Telerik UI for ASP.NET AJAX, and which version? Progress says a developer can open the project in Visual Studio and read the version of the Telerik library file listed under References. Include applications that outside vendors built for you.
Second, when will affected systems move to 2026.3.812 or later? Progress calls upgrading the only remediation that fully closes the chain. It says customers on a current maintenance agreement can download the upgrade from their account. Those without one need to talk to a Progress account representative.
Third, what covers the gap until then? Progress suggests several steps. Confirm the application pool identity cannot write to the web root. Disable script execution on writable folders. Remove the affected controls, or disable the dialog handler if the application does not need it. Progress warns these steps reduce risk and are not a substitute for upgrading. It also says blocking one literal URL is not a confirmed mitigation.
Fourth, because Progress says exploitation leaves no obvious trace in standard error logs, what other evidence can we check? Should keys on unpatched systems be treated as exposed?
A patch closes the bug that was reported. Whether the area around it is sound is a separate question, and it belongs on the agenda.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Progress Software (Telerik).
