{"id":"CVE-2019-18935","aliases":["EUVD-2019-8608","GHSA-c655-3j45-33xw"],"status":"published","title":"Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization...","description":"Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99737,"percentile":0.99953,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-502"],"published":"2019-12-11T00:00:00Z","modified":"2026-06-17T02:25:36Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"pocgithub","id":"bao7uo/RAU_crypto","title":"bao7uo/RAU_crypto","date":"2018-01-09","url":"https://github.com/bao7uo/RAU_crypto"},{"source":"metasploit","id":"exploit/windows/http/telerik_rau_deserialization","title":"Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization","type":"exploit","platform":"Windows","date":"2019-12-09","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/telerik_rau_deserialization"},{"source":"pocgithub","id":"noperator/CVE-2019-18935","title":"noperator/CVE-2019-18935","date":"2019-12-12","url":"https://github.com/noperator/CVE-2019-18935"},{"source":"exploitdb","id":"EDB-47793","title":"Telerik UI - Remote Code Execution via Insecure Deserialization","type":"webapps","platform":"aspx","date":"2019-12-18","url":"https://www.exploit-db.com/exploits/47793"},{"source":"pocgithub","id":"becrevex/Telerik_CVE-2019-18935","title":"becrevex/Telerik_CVE-2019-18935","date":"2020-05-17","url":"https://github.com/becrevex/Telerik_CVE-2019-18935"},{"source":"pocgithub","id":"ThanHuuTuan/Telerik_CVE-2019-18935","title":"ThanHuuTuan/Telerik_CVE-2019-18935","date":"2020-05-25","url":"https://github.com/ThanHuuTuan/Telerik_CVE-2019-18935"},{"source":"pocgithub","id":"ThanHuuTuan/CVE_2019_18935","title":"ThanHuuTuan/CVE_2019_18935","date":"2020-05-29","url":"https://github.com/ThanHuuTuan/CVE_2019_18935"},{"source":"pocgithub","id":"murataydemir/CVE-2019-18935","title":"murataydemir/CVE-2019-18935","date":"2020-08-19","url":"https://github.com/murataydemir/CVE-2019-18935"},{"source":"pocgithub","id":"appliedi/Telerik_CVE-2019-18935","title":"appliedi/Telerik_CVE-2019-18935","date":"2020-08-26","url":"https://github.com/appliedi/Telerik_CVE-2019-18935"},{"source":"pocgithub","id":"random-robbie/CVE-2019-18935","title":"random-robbie/CVE-2019-18935","date":"2020-09-30","url":"https://github.com/random-robbie/CVE-2019-18935"},{"source":"pocgithub","id":"0xAgun/CVE-2019-18935-checker","title":"0xAgun/CVE-2019-18935-checker","date":"2021-10-29","url":"https://github.com/0xAgun/CVE-2019-18935-checker"},{"source":"pocgithub","id":"KasunPriyashan/Telerik-UI-ASP.NET-AJAX-Exploitation","title":"KasunPriyashan/Telerik-UI-ASP.NET-AJAX-Exploitation","date":"2022-10-13","url":"https://github.com/KasunPriyashan/Telerik-UI-ASP.NET-AJAX-Exploitation"},{"source":"pocgithub","id":"dust-life/CVE-2019-18935-memShell","title":"dust-life/CVE-2019-18935-memShell","date":"2023-12-25","url":"https://github.com/dust-life/CVE-2019-18935-memShell"},{"source":"pocgithub","id":"clarkvoss/telerik","title":"clarkvoss/telerik","date":"2025-03-01","url":"https://github.com/clarkvoss/telerik"},{"source":"pocgithub","id":"ekkoo-z/CVE-2019-18935-bypasswaf","title":"ekkoo-z/CVE-2019-18935-bypasswaf","date":"2025-07-09","url":"https://github.com/ekkoo-z/CVE-2019-18935-bypasswaf"},{"source":"pocgithub","id":"0xsharz/telerik-scanner-CVE-2019-18935","title":"0xsharz/telerik-scanner-CVE-2019-18935","date":"2025-08-22","url":"https://github.com/0xsharz/telerik-scanner-CVE-2019-18935"},{"source":"pocgithub","id":"quyt0/CVE-2019-18935-exploit-study","title":"quyt0/CVE-2019-18935-exploit-study","date":"2025-09-11","url":"https://github.com/quyt0/CVE-2019-18935-exploit-study"},{"source":"pocgithub","id":"menashe12346/CVE-2019-18935","title":"menashe12346/CVE-2019-18935","date":"2025-10-23","url":"https://github.com/menashe12346/CVE-2019-18935"},{"source":"pocgithub","id":"alanbarret/CVE-2019-18935","title":"alanbarret/CVE-2019-18935","date":"2025-12-08","url":"https://github.com/alanbarret/CVE-2019-18935"}],"products":[{"vendor":"progress","product":"telerik ui for asp.net ajax"},{"vendor":"telerik","product":"ui_for_asp.net_ajax"}],"references":[{"url":"https://www.telerik.com/support/whats-new/release-history","tags":["x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html","tags":["x_transferred","Not Applicable"]},{"url":"https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://github.com/bao7uo/RAU_crypto","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/noperator/CVE-2019-18935","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html","tags":["x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-%28version-2020-1-114%29","tags":["x_transferred","Release Notes"]},{"url":"http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data/","tags":["x_transferred","Press/Media Coverage"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18935","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18935"},{"url":"https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-(version-2020-1-114)"},{"url":"https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data"},{"url":"https://github.com/advisories/GHSA-c655-3j45-33xw"}],"sources":{"cve":[{"id":"CVE-2019-18935","description":"Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)","status":"published","published":"2019-12-11T00:00:00Z","modified":"2025-10-21T23:35:56.289Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2019-8608","description":"Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)","status":"published","published":"2019-12-11T00:00:00Z","modified":"2025-10-21T23:35:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-c655-3j45-33xw","title":"Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization...","description":"Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (In 2019.3.1023 but not earlier versions, a non-default setting can prevent exploitation.)","status":"published","published":"2022-05-24T17:03:14Z","modified":"2025-10-22T00:32:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2019-18935","title":"Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","description":"Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.","cwes":["CWE-502"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2019-18935","description":"Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)","status":"published","published":"2019-12-11T13:15:11.767Z","modified":"2026-06-17T02:25:36.353Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:05:40.258829Z"}]}}