Attack Chain

1. The attacker identifies a web application using a vulnerable version of Progress Telerik UI for AJAX with the RadAsyncUpload component enabled.
2. The attacker crafts an HTTP request to initiate a file upload to the RadAsyncUpload endpoint.
3. The attacker splits the malicious file into multiple chunks, each smaller than the initially configured maximum upload size limit.
4. The attacker sends each chunk to the server using separate HTTP requests to the RadAsyncUpload endpoint.
5. The server receives the chunks and stores them temporarily, without enforcing the cumulative file size.
6. Once all chunks are uploaded, the RadAsyncUpload component reassembles the file.
7. Due to the missing cumulative size check, the reassembled file exceeds the maximum allowed file size.
8. The server stores the complete, oversized file, leading to disk space exhaustion.

Impact

Successful exploitation of this vulnerability can lead to a denial-of-service condition due to disk space exhaustion. The number of affected systems depends on the usage of the vulnerable Telerik UI for AJAX RadAsyncUpload component. Organizations in any sector using the affected Telerik component are potentially vulnerable. If successful, the attack can cause application downtime, data loss, and require administrative intervention to restore service.

Recommendation

• Upgrade Progress Telerik UI for AJAX to version 2026.1.421 or later to patch CVE-2026-6022.
• Implement server-side monitoring for excessive disk space usage in directories associated with RadAsyncUpload temporary file storage.
• Deploy the Sigma rule DetectSuspiciousRadAsyncUploadChunks to detect potential exploitation attempts.
• Review and harden file upload size limits to prevent resource exhaustion, as described in the Telerik documentation referenced.