Telerik Report Server: External control of configuration setting allows account takeover
Summary
Telerik Report Server prior to version 12.3.26.1110 allows an unauthenticated remote attacker to influence the server address the application uses when generating links and notifications. If a user interacts with a manipulated link or notification, sensitive information can be disclosed and accounts can be taken over. The CVSS score is 8.8 (high).
Affected
- Progress Telerik Report Server prior to 12.3.26.1110
- Embedded Telerik Reporting is not affected.
- Whether older release branches (e.g. 12.2.x) are affected is unknown.
Fixed in
- Upgrade to Telerik Report Server 12.3.26.1110 or later.
Workaround
- No vendor workaround is documented.
- Restrict internet access to the server until it is patched.
- After upgrading, verify that the Server URL in the Report Server configuration contains the correct public address and set it explicitly if necessary.
Exploitation
- No evidence of active exploitation known at the time of research.
- Not listed in CISA KEV; no public exploit found.
- The CVE was published on 11 November 2026, so this status may change quickly.
Our recommendation
- Inventory all Telerik Report Server instances and their exact versions, including older branches.
- Upgrade to 12.3.26.1110 or later and verify the Server URL setting afterwards.
- Until patched, restrict external access to the server.
- Check whether SMTP and link-generation settings have been changed unexpectedly.
- Review admin and user accounts for signs of compromise, especially after phishing attempts.
- Also patch CVE-2026-106133, which is fixed in the same version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik KB: CVE-2026-106152 (vendor advisory) www.telerik.com
- Offseq Radar: CVE-2026-106152 radar.offseq.com
- ThreatInt: CVE-2026-106152 cve.threatint.com
- Telerik Report Server security best practices www.telerik.com
- Offseq Radar: CVE-2026-106133 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:22.
Original description (NVD)
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.