Live › vulnerability › CVE-2019-18935
Go to dashboardProgress Telerik UI for ASP.NET AJAX deserializes untrusted data through the RadAsyncUpload control, letting an unauthenticated request run code on the server. The attacker gets code execution as the w3wp.exe IIS worker process, and CISA lists it as actively exploited, including in ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Progress Telerik UI for ASP.NET AJAX | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the vendor update from Progress per the CISA required action; the fixed version is not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
This page as .md · .json · in your agent: get_signal("CVE-2019-18935")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.