A devastating combination of a padding oracle bug and an unauthenticated remote code execution vulnerability in Telerik UI components has been discovered, leaving numerous organizations vulnerable to serious attacks. The severity of this issue is compounded by the fact that it affects not only authenticated users but also those who are not logged in, making it a threat to any user interacting with affected systems.
Telerik UI is a widely used software development kit (SDK) for building web applications, and its components are integrated into many enterprise environments. The company’s padding oracle bug, discovered earlier this year, allows attackers to extract sensitive information from the application, including authentication tokens and session IDs. When combined with an unauthenticated remote code execution vulnerability, which allows attackers to inject malicious code directly into the application, the consequences become catastrophic.
The exploitation of these vulnerabilities is made possible due to a design flaw in the Telerik UI components, particularly in their handling of cross-domain requests. Normally, web applications use techniques like same-origin policy and CORS (Cross-Origin Resource Sharing) to prevent unauthorized access between domains. However, in this case, an attacker can manipulate the application’s behavior by exploiting the padding oracle bug, which enables them to bypass these security measures.
As a result, attackers gain the ability to execute arbitrary code on the server-side, allowing for data exfiltration, lateral movement within the network, and even full system compromise. Given that this vulnerability affects not only authenticated users but also those who are not logged in, it poses a significant risk to organizations with publicly accessible web applications or those with weak authentication mechanisms.
The situation is further complicated by the fact that public exploit code for these vulnerabilities has been released, making it easier for attackers to launch targeted attacks against vulnerable systems. This highlights the need for swift action from affected organizations to patch their systems and prevent potential breaches.
Given the severity of this issue, we advise all organizations using Telerik UI components to take immediate action. First and foremost, ensure that you have applied the latest security patches and updates for your application and its dependencies. Next, conduct a thorough risk assessment to identify areas where sensitive data may be exposed or vulnerable to unauthorized access. Finally, consider implementing additional security measures such as web application firewalls (WAFs) and intrusion detection systems (IDS) to detect and prevent potential attacks.
It’s essential to emphasize that this situation underscores the importance of prioritizing software security and keeping dependencies up-to-date. The intersection of these vulnerabilities serves as a stark reminder of the risks associated with legacy code and unpatched libraries, and we urge all developers and administrators to remain vigilant in their pursuit of secure coding practices.
Source: The Hacker News — 2026-09-07