Progress Telerik Report Server: Configuration setting vulnerability (CVE-2026-106152)
Progress Telerik Report Server versions prior to 12.3.26.1110 are vulnerable to an external control of a system configuration setting, allowing unauthenticated remote attackers to influence generated notification links and potentially achieve account takeover.
CVE search metadata
CVE search record: CVE-2026-106152. Severity: high. CVSS: 8.8. KEV: no. Product: Telerik Report Server (< 12.3.26.1110). Brief: Progress Telerik Report Server: Configuration setting vulnerability (CVE-2026-106152). Brief link: https://feed.craftedsignal.io/briefs/2026-11-telerik-report-server-config-cve-2026-106152/
Triage facts
Revision 1- Applicability
- Telerik Report Server (< 12.3.26.1110)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 20:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
Progress Telerik Report Server versions prior to 12.3.26.1110 contain a vulnerability regarding external control of system configuration settings (CVE-2026-106152). An unauthenticated remote attacker can influence the server address used by the Report Server when generating notification links and system communications.
Impact
Exploitation of this vulnerability, combined with user interaction, may lead to the disclosure of sensitive information and potential account takeover.
Recommendation
- Upgrade Progress Telerik Report Server to version 12.3.26.1110 or later immediately.
- Review server access logs for anomalous requests to Report Server configuration endpoints that may indicate attempts to influence system settings.
Immediate actions
Upgrade Telerik Report Server to 12.3.26.1110 or later
Threat Hunt
Investigate web server logs for suspicious parameters or modification requests targeting configuration or server address settings within the Telerik Report Server interface.
Data: Web server access logs (e.g., IIS or relevant web server logs)
Mitigations
Upgrade to Telerik Report Server 12.3.26.1110
CVE-2026-106152