Progress Telerik UI for ASP.NET AJAX RadAsyncUpload Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2019-18935) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTProgress Telerik UI for ASP.NET AJAX versions through 2019.3.1023 (and certain configurations prior to 2020.1.114)
If encryption keys are compromised or known, attackers can exploit the RadAsyncUpload function to deserialize malicious .NET objects, resulting in unauthorized Remote Code Execution (RCE) on the target web server.
Upgrade Telerik UI to version 2020.1.114 or later, or immediately modify web.config to disable RadAsyncUpload or rotate the encryption keys.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade Telerik UI for ASP.NET AJAX to version 2020.1.114 or later. If you manage dependencies via NuGet, execute the following command in the Package Manager Console:
# Update Telerik UI package via NuGet Package Manager Console
Update-Package Telerik.UI.for.AspNet.Ajax -Version 2020.1.1142. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, secure your web.config by disabling RadAsyncUpload or rotating the default encryption keys to strong, unique values.
<!-- web.config hardening example: Rotate keys and disable vulnerable features -->
<configuration>
<appSettings>
<!-- Replace default keys with strong, unique 32-byte random strings -->
<add key='Telerik.Web.UI.DialogParametersEncryptionKey' value='StrongRandomKey_32BytesOrMore_ChangeThis!' />
<add key='Telerik.Upload.ConfigurationEncryptionKey' value='StrongRandomKey_ForUpload_ChangeThis!' />
<!-- Disable RadAsyncUpload if it is not required by the application -->
<add key='Telerik.AsyncUpload.DisableAsyncUpload' value='true' />
</appSettings>
</configuration>3. Log Audit & IoC Verification Commands
Use the following PowerShell script to inspect IIS logs for suspicious POST requests targeting the Telerik WebResource handler:
# Search IIS logs for suspicious POST requests to the Telerik handler
$LogPath = 'C:\inetpub\logs\LogFiles\W3SVC1\*'
Get-ChildItem -Path $LogPath -Filter *.log |
Select-String -Pattern 'Telerik.Web.UI.WebResource.axd' |
Where-Object { $_ -match 'POST' } |
Select-Object -First 50 |
Format-Table LineBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2019-18935) is a critical .NET deserialization flaw within the RadAsyncUpload component of Progress Telerik UI for ASP.NET AJAX. The RadAsyncUpload module serializes and deserializes metadata and configuration parameters during file upload operations. Due to a lack of robust type validation during deserialization (CWE-502), the application is susceptible to object injection. If an attacker obtains or guesses the encryption keys (e.g., via CVE-2017-11317 or CVE-2017-11357), they can craft a serialized payload, encrypt it using the compromised keys, and force the server to deserialize it.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates the exploit by targeting the Telerik.Web.UI.WebResource.axd handler with a specially crafted HTTP POST request. The payload contains a serialized JSON object designed to exploit .NET's JavaScriptSerializer or similar deserialization binders. By embedding specific gadget chains (such as System.Configuration.Install.AssemblyInstaller), the attacker forces the IIS worker process (w3wp.exe) to load and execute arbitrary DLLs or system commands upon deserialization, bypassing authentication entirely.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and inclusion in the CISA KEV catalog, this vulnerability is actively exploited in the wild by ransomware operators and APT groups. Successful exploitation grants the attacker full control over the web application server, enabling lateral movement within the internal network, database credential theft, web defacement, and deployment of persistent web shells.
Official Vendor Advisories & References
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
Frequently Asked SecOps Questions (CVE-2019-18935)
FAQQ1. How critical is CVE-2019-18935 and is it actively exploited in the wild?
CVE-2019-18935 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-18935?
Primary impacted vendors include progress, telerik across telerik_ui_for_asp.net_ajax. Scope summary: Progress Telerik UI for ASP.NET AJAX versions through 2019.3.1023 (and versions prior to 2020.1.114 depending on default settings)
Q3. What temporary mitigations or workarounds exist for CVE-2019-18935 before patching?
[Mitigation] Upgrade Telerik UI to version 2020.1.114 or later, or immediately modify web.config to disable RadAsyncUpload or rotate the encryption keys. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-18935
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (progress)
View Category →Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)
[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances
JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)
[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.