CVE-2019-18935Vulnerability
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
Reported by 2 independent sources · first reported by Recorded Future · last reported
Last reported 17 days ago
Fix due 3 May 2022
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 15 Oct 2026
What the reports say
3 reports, newest first · the exact sentence from each-
Q3 2026 Statistical Report on Malware Targeting Windows Web Servers“CVE-2019-18935 is a .NET deserialization vulnerability in RadAsyncUpload; when exploited, it allows remote code execution with the privileges of the w3wp.Exe process on an IIS web server.”
-
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability“…urity intelligence Center (ASEC) has identified two vulnerability attack cases that exploited a remote code execution vulnerability (CVE-2019-18935) targeting unpatched Telerik UI for ASP.NET AJAX servers.”
-
August 2026 CVE Landscape“CVE-2019-18935”
Indicators reported together
named in the same reports- 0a4be0b6c650ffdcd1c22db56f1c4aecin 2 reports
- 10f705728d228ad949b7894c1a85a2b1in 2 reports
- 177e34d9174766a1d187a0c82de4c02fin 2 reports
- 18fb4e070653fc9791e0e408d8cb1c8ein 2 reports
- 1dbfda02d74b6a7586c4430175204c28in 2 reports
- hxxp://2.59.133[.]147:31338/ins.txtin 2 reports
- 2.59.133[.]147in 2 reports
- hxxp://2.59.133[.]147:31338/sm.jsonin 2 reports
- hxxp://206.82.6[.]22/in 2 reports
- 206.82.6[.]22in 2 reports
- hxxp://45.138.16[.]187:31337/bb.jsonin 2 reports
- 45.138.16[.]187in 2 reports
- hxxp://45.138.16[.]187:31337/cofuz.jsonin 2 reports
Copy these 13 indicators · defanged
Also named with it: CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-0300
Thanks — we review every report.