Skip to content
OpenAdvisories
High WID-SEC-2026-3823 2 CVEs

Progress Software Telerik Report Server: Mehrere Schwachstellen

Published Oct 8, 2026 · Updated Oct 8, 2026 · de-DE

Vendor: Progress Software Product: Telerik Report Server Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Progress Software Telerik Report Server ausnutzen, um seine Privilegien zu erhöhen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

Der Telerik Report Server bietet eine Plattform zur Erstellung, Verwaltung und Verteilung von Berichten in einem Unternehmen.

Vulnerabilities 2

  • High 8.9
    CVE-2026-106155

    Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers

    In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML tex…

    Progress Software Telerik Report Server
  • High 7.1
    CVE-2026-106145

    Privilege Escalation in Telerik Report Server Service-Agent Hub

    In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted ser…

    Progress Software Telerik Report Server

Revision history

  1. #1

    Initiale Fassung

References

  • Progress Advisory vom 2026-10-08
    https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-privilege-assignment-cve-2026-106145
  • Progress Advisory vom 2026-10-08
    https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-improper-neutralization-of-input-cve-2026-106155