CVE-2026-106155

HighCVSS 8.9

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Risk Assessment

In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session. This may lead to account takeover and unauthorized system changes.

Recommendation

Update Telerik Report Server to version 12.2.26.1007 or later. Restrict report author privileges and monitor for unusual activity in privileged user sessions.

Other vulnerabilities in Telerik Report Server

CVE-2026-106145High
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys.

Original NVD description (English source)

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS