All vulnerabilities
CVE-2026-106155

Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers

Progress Software Telerik Report Server
Open in ThreatlineRecord JSON
CVSS
8.9High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.2.26.1007Fixed versionCVE List
Published9 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 12.2.26.1007Telerik Report ServerCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.

Text from CVE List

Affected versions 1

  • Telerik Report Serveraffected: all versions before 12.2.26.1007CVE List

References 1