Cyber Centre lists flaws in several Progress Telerik products
Original title: Progress Software security advisory (AV26-1148)
Five CVEs cover race conditions, deserialization, configuration control, and code generation; exploitation is not stated.
On November 12, 2026, the Canadian Centre for Cyber Security issued AV26-1148 on vulnerabilities in Progress Software Telerik products. Named issues include a ClassFactory race condition, deserialization of untrusted data, external control of a configuration setting, and improper code generation. The centre asks users and administrators to review Progress links and apply updates as they become available.
Unconfirmed: The notice does not state exploitation status, severity, or whether fixed builds are already available.
- Telerik Report Server prior to 12.3.26.1110 is listed as affected.
- Telerik Reporting prior to 20.3.26.1110 is listed as affected.
- UI for ASP.NET Core, WPF, and WinForms have stated version cutoffs.
- CVE-2026-106137 is tied to Telerik UI for ASP.NET MVC.
- The notice does not say whether fixes are already available.
| Product | Affected |
|---|---|
| Progress Software Telerik Report Server | Prior to 12.3.26.1110 |
| Progress Software Telerik Reporting | Prior to 20.3.26.1110 |
| Progress Software Telerik UI for ASP.NET Core | Prior to 2026.3.1015 |
| Progress Software Telerik UI for WPF | Prior to 2026.4.1110 |
| Progress Software Telerik UI for WinForms | Prior to 2026.4.1111 |
| Progress Software Telerik UI for ASP.NET MVC | — |
- 1.Review the Progress links in AV26-1148 and apply updates as they become available.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-106137 | Race condition in Telerik UI for ASP.NET MVC aggregation | 8.6 | — | ||
| CVE-2026-106140 | Untrusted deserialization in Telerik Reporting designers before 20.3.26.1110 | 7.3 | — | ||
| CVE-2026-106152 | External config control in Telerik Report Server before 12.3.26.1110 | 8.8 | — | ||
CVE-2026-124699+1 related CVE | Code injection in Telerik UI for WinForms before 2026.4.1111 | 7.8 | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1148 Date: November 12, 2026 As of November 12, 2026, Progress Software is affected by vulnerabilities in the following products: Telerik Report Server Prior to 12. 3. 26.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.