Cyber Centre lists flaws in several Progress Telerik products
Five CVEs cover race conditions, deserialization, configuration control, and code generation; exploitation is not stated.
42
CVE-2026-106152
External config control in Telerik Report Server before 12.3.26.1110
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Progress Telerik Report Server before 12.3.26.1110 lets an unauthenticated remote attacker change the server address used when the product generates links and notifications. A user must interact with the resulting content. That can disclose sensitive information and lead to account takeover. Installations older than 12.3.26.1110 are affected.
What to do: Upgrade Telerik Report Server to 12.3.26.1110.
| Product | Affected | Fixed in |
|---|---|---|
| Progress Telerik Report Server | prior to 12.3.26.1110 | 12.3.26.1110 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.
- Weakness
- CWE-15
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H