Telerik UI Exploitation Leads to Webshell Install and Scanner Execution

Reported 28 Sep 2026 by otx · Severity: medium

Multiple attack campaigns exploiting CVE-2019-18935, a remote code execution vulnerability in unpatched Telerik UI for ASP.NET AJAX servers, have been identified. The first case involved exploiting the vulnerability to execute a reverse shell connecting to 206.82.6.22, attempting