Is CVE-2026-106140 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106140 being exploited in the wild.

How severe is CVE-2026-106140?

High severity, with a CVSS score of 7.3, published 12 November 2026.

Which products and versions are affected?

Progress Telerik Reporting 0 to <20.3.26.1110 (.NET Framework report designers only).

How is CVE-2026-106140 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-106140?

Check whether you run Progress Telerik Reporting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106140: Progress Telerik Reporting deserialization vulnerability in .NET report designers

Q: Is there a fix for CVE-2026-106140?

Yes: fixed in 20.3.26.1110. Until then: Upgrade to version 20.3.26.1110 or later. Note that report items copied with earlier designer versions cannot be pasted into the updated designer, and Visual Studio-specific content such as event handlers is not preserved when copying between separate instances. [ { "kind": "disclosed", "at": "2026-11-12", "note": "CVE-2026-106140 published" }, { "kind": "patched", "at": "2026-11-12", "note": "Fix released in version 20.3.26.1110" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-106140 · Severity: high · CVSS 7.3 · Published 2026-11-12

Telerik Reporting's .NET Framework-based report design tools contain a flaw that allows an attacker to execute arbitrary code when a designer user performs editing operations. A local attacker with low privileges can exploit this to gain full control over the designer process, potentially compromising report data and the design environment. The .NET 8+ report designer is not affected.

Vendors: Progress.

Quick answers

Is CVE-2026-106140 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106140 being exploited in the wild.
How severe is CVE-2026-106140?: High severity, with a CVSS score of 7.3, published 12 November 2026.
Which products and versions are affected?: Progress Telerik Reporting 0 to <20.3.26.1110 (.NET Framework report designers only).
Is there a fix for CVE-2026-106140?: Yes: fixed in 20.3.26.1110. Until then: Upgrade to version 20.3.26.1110 or later. Note that report items copied with earlier designer versions cannot be pasted into the updated designer, and Visual Studio-specific content such as event handlers is not preserved when copying between separate instances.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-12", "note": "CVE-2026-106140 published" }, { "kind": "patched", "at": "2026-11-12", "note": "Fix released in version 20.3.26.1110" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106140 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-106140?: Check whether you run Progress Telerik Reporting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 20.3.26.1110

Upgrade to version 20.3.26.1110 or later. Note that report items copied with earlier designer versions cannot be pasted into the updated designer, and Visual Studio-specific content such as event handlers is not preserved when copying between separate instances.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-12", "note": "CVE-2026-106140 published" }, { "kind": "patched", "at": "2026-11-12", "note": "Fix released in version 20.3.26.1110" } ]

Technical details

A deserialization of untrusted data vulnerability (CWE-502) in the Standalone Report Designer and Visual Studio Report Designer allows local privilege escalation to arbitrary code execution. The vulnerability requires local access and user interaction (editing operations), affecting .NET Framework versions but not .NET 8+ implementations. A fix is available in version 20.3.26.1110.

Affected products

Progress Telerik Reporting 0 to <20.3.26.1110 (.NET Framework report designers only)

References

https://www.telerik.com/products/reporting/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-106140

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.