CVE-2026-106155: high-severity vulnerability in Progress Software Telerik Report Server
Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.9epss 0.2%
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Affected products
Progress Software · Telerik Report ServerRelated CVEs — Progress Software Telerik Report Server
In the same product, most dangerous first.
CVE-2024-4357MEDIUMXML External Entity Processing Information DisclosureEPSS 0.7%CVE-2024-4837MEDIUMTrust Boundary Violation VulnerabilityEPSS 0.4%CVE-2025-0556HIGHTelerik Report Server Clear Text Transmission of Agent CommandsEPSS 0.3%CVE-2026-106145HIGHPrivilege Escalation in Telerik Report Server Service-Agent HubEPSS 0.1%