Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability

CVE-2019-18935

September 27, 2026 · AhnLab ASEC · Severity: HIGH

AhnLab ASEC reports two real-world attack cases exploiting an older Telerik UI vulnerability (CVE-2019-18935). The attackers used the remote code execution to install web shells and attempt privilege escalation. This highlights that unpatched software continues to be a viable attack vector. 📌 **Analyst Note:** This case demonstrates that attackers will exploit vulnerabilities years after disclosure if patches are not applied. Organizations should prioritize scanning for CVE-2019-18935 and ensuring all Telerik UI installations are updated, as it provides a reliable foothold for further compromise.

Key Takeaways

Attackers are actively exploiting CVE-2019-18935, a remote code execution vulnerability in Telerik UI for ASP.NET AJAX, to install web shells and privilege escalate.
Two distinct attack cases were observed where reverse shells were executed, privilege escalation was attempted, and persistent web shells were deployed on unpatched servers.
Despite being a known vulnerability since 2019, these cases show that many systems remain unpatched and are still being targeted by attackers for initial access.