Deserialization Vulnerability in Progress® Telerik® Reporting for .NET Framework
CVE-2026-106140

7.3HIGH

Key Information:

Vendor

Progress Software
Status
Telerik Reporting
Vendor
CVE Published:
12 November 2026

What is CVE-2026-106140?

A vulnerability exists in Progress® Telerik® Reporting prior to version 20.3.26.1110, where a local attacker with low privileges can exploit the .NET Framework report designers. By performing certain editing operations, the attacker can execute arbitrary code within the context of the designer process, potentially compromising the system.

Affected Version(s)

Telerik Reporting 0 < 20.3.26.1110

References

https://www.telerik.com/products/reporting/documentation/...
vendor-advisory

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.