critical

CVE-2026-13181

Telerik UI for ASP.NET AJAX unsafe type resolution in RadAsyncUpload AsyncUploadTypeName -> remote code execution

Severity: critical
Affected product: Telerik UI for ASP.NET AJAX
Affected versions: Telerik UI for ASP.NET AJAX ≥ 2010.1.309, < 2026.2.708
Fixed in: Telerik UI for ASP.NET AJAX 2026.2.708
Detection basis: Component version range
Shipped rule: Telerik UI for ASP.NET AJAX: Telerik UI for ASP.NET AJAX unsafe type resolution in RadAsyncUpload AsyncUploadTypeName -> remote code execution
Added to NewScan: 2026-09-07
Detected by: NewScan — free, self-hosted

How NewScan reports it

COMPONENT VERSION RANGE

NewScan fingerprints Telerik UI for ASP.NET AJAX from its response and reports this CVE when the detected version falls inside the affected range below.

References

NVD — CVE-2026-13181 ↗
CVE Record ↗

Scan for this yourself — local, in-band scanning is free.

Get NewScan (FREE) →

Review the measured benchmark, then use the verified remediation process.