CVE-2019-18935: Telerik UI for ASP.NET AJAX RadAsyncUpload deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing with known ransomware use, near-maximum EPSS probability, and public exploit code make this an urgent patch-first issue.

What it is

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization flaw in the RadAsyncUpload function, allowing untrusted data to be deserialized. It is exploitable when the encryption keys are known, which can result from CVE-2017-11317 or CVE-2017-11357, and leads to remote code execution. The 2020.1.114 release adds a default setting that prevents the exploit.

Impact

An attacker can execute arbitrary code on the server hosting the vulnerable Telerik UI component. This yields full compromise of the web application and its underlying host.

Attack surface

Reachable over the network via the RadAsyncUpload endpoint with no authentication or user interaction required per the CVSS vector. Exploitation depends on the attacker knowing the encryption keys, which may be obtained through related vulnerabilities or other means.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is 0.99737 (99.953rd percentile). Multiple public exploit references exist, including Packet Storm, GitHub PoCs and Bishop Fox research.

What to do

• Upgrade Telerik UI for ASP.NET AJAX to 2020.1.114 or later, which enables a default setting that blocks the exploit.
• If immediate upgrade is not possible, apply the vendor workaround to disable the JavaScriptSerializer deserialization path as documented in the Telerik knowledge base.
• Rotate and protect the Telerik RadAsyncUpload encryption keys, and remediate CVE-2017-11317 and CVE-2017-11357 so keys cannot be recovered.
• Restrict network access to Telerik UI endpoints and monitor for unexpected upload or deserialization activity.

Detection

• Monitor web server and application logs for requests to RadAsyncUpload handlers with unusual or malformed payloads.
• Alert on outbound network connections or process creation from the web server process (w3wp.exe) that are not part of normal application behavior.
• Search for known exploit artifacts such as the RAU_crypto or CVE-2019-18935 tooling signatures in file uploads or HTTP traffic.
• Review for signs of post-exploitation activity consistent with ransomware deployment on hosts running the vulnerable component.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.