Quick answers
- Is CVE-2026-106152 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-106152 being exploited in the wild.
- How severe is CVE-2026-106152?
- High severity, with a CVSS score of 8.8, published 11 November 2026.
- Which products and versions are affected?
- Progress Telerik Report Server prior to 12.3.26.1110.
- Is there a fix for CVE-2026-106152?
- Yes: fixed in 12.3.26.1110. Until then: Administrators should verify that the Server URL in the Report Server configuration contains the correct public address of the server and set it explicitly if necessary. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-106152 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-106152?
- Check whether you run Progress Telerik Report Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 12.3.26.1110
Administrators should verify that the Server URL in the Report Server configuration contains the correct public address of the server and set it explicitly if necessary.
Technical details
The vulnerability allows external control of the server address configuration setting used when Report Server generates links and notifications (CWE-15). An unauthenticated remote attacker with network access can influence this setting without authentication, but exploitation requires user interaction—typically when a user clicks a malicious link. This enables account takeover and disclosure of sensitive information through phishing or similar attacks.
Affected products
- Progress Telerik Report Server prior to 12.3.26.1110
Timeline
- 2026-11-11: disclosed