A critical vulnerability in Progress Telerik UI for ASP.NET AJAX allows unauthenticated remote code execution if an attacker possesses specific application encryption key material.

The vulnerability arises from insufficient verification of data authenticity within the RadEditor file browser dialog. This allows an unauthenticated attacker to manipulate file path parameters to upload malicious files, provided they have first obtained the necessary application encryption keys.

Successful exploitation of this flaw can lead to full remote code execution on the underlying server, granting an attacker complete control over the application environment. Given the CVSS score of 8.1, this represents a high-severity risk that could facilitate data exfiltration, service disruption, and unauthorized access to sensitive corporate infrastructure.

Immediate Action: Upgrade to Telerik UI for ASP.NET AJAX version 2026.3.812 or later immediately to apply the necessary integrity checks.

Proactive Monitoring: Monitor server access logs for unusual file upload activity or requests directed at the RadEditor file browser handler that exhibit suspicious path manipulation patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized attempts to interact with Telerik dialog handlers or suspicious file upload extensions.

Public Exploit Available: No

Organizations utilizing Progress Telerik UI for ASP.NET AJAX must treat this vulnerability with high urgency. Administrators should prioritize patching all internet-facing instances of the software to version 2026.3.812. Ensure that application encryption keys are managed securely and rotated regularly, as they serve as a critical component in preventing the successful exploitation of this flaw.