Cyber Centre lists flaws in several Progress Telerik products
Five CVEs cover race conditions, deserialization, configuration control, and code generation; exploitation is not stated.
42
CVE-2026-106140
Untrusted deserialization in Telerik Reporting designers before 20.3.26.1110
- CVSS 3.1
- 7.3 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Progress Telerik Reporting before 20.3.26.1110 has an untrusted-data deserialization flaw in the .NET Framework report designers. A local attacker with low privileges can run arbitrary code in the designer process when a user performs certain editing operations. Users of those designers on affected builds are exposed.
What to do: Upgrade Progress Telerik Reporting to 20.3.26.1110 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Progress Telerik Reporting | prior to 20.3.26.1110 | 20.3.26.1110 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H