Is CVE-2026-106155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106155 being exploited in the wild.

How severe is CVE-2026-106155?

High severity, with a CVSS score of 8.9, published 9 October 2026.

Which products and versions are affected?

Progress Telerik Report Server prior to 12.2.26.1007.

How is CVE-2026-106155 attacked?

It is attacked over the network.

Am I affected by CVE-2026-106155?

Check whether you run Progress Telerik Report Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106155: Progress Telerik Report Server stored XSS in shared reporting engine

CVE-2026-106155 · Severity: high · CVSS 8.9 · Published 2026-10-09

Progress Telerik Report Server is an enterprise reporting platform that allows authors to create and publish reports viewed by other users. A malicious report author can embed JavaScript code in navigation links or text boxes that executes in other users' browsers when they view the report, potentially allowing privilege escalation if a higher-privileged user (such as an administrator) views the compromised report. This could lead to unauthorized actions, data theft, or account takeover within the Report Server system.

Technologies: Progress Telerik Report Server. Vendors: Progress.

Quick answers

Is CVE-2026-106155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106155 being exploited in the wild.
How severe is CVE-2026-106155?: High severity, with a CVSS score of 8.9, published 9 October 2026.
Which products and versions are affected?: Progress Telerik Report Server prior to 12.2.26.1007.
Is there a fix for CVE-2026-106155?: Yes: fixed in 12.2.26.1007. Until then: Reports using javascript: or vbscript: navigation intentionally must be revised, as these URL schemes are now blocked across renderers. Restrict report authoring permissions to trusted users until the upgrade can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106155 attacked?: It is attacked over the network.
Am I affected by CVE-2026-106155?: Check whether you run Progress Telerik Report Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 12.2.26.1007

Reports using javascript: or vbscript: navigation intentionally must be revised, as these URL schemes are now blocked across renderers. Restrict report authoring permissions to trusted users until the upgrade can be applied.

Technical details

A stored cross-site scripting vulnerability exists in the shared reporting engine where unsafe javascript: and vbscript: URLs are not properly sanitized in report navigation actions and HTML text box anchor elements. An authenticated report author can inject malicious URLs that are stored in the report and executed in the context of the web report viewer (another user's authenticated session) when the victim interacts with the navigation. The vulnerability affects versions prior to 12.2.26.1007 and is exploitable against any user viewing the malicious report, with particular impact when targeting administrators.

Affected products

Progress Telerik Report Server prior to 12.2.26.1007

Timeline

2026-10-09: disclosed
2026-10-08: patched

References

https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-improper-neutralization-of-input-cve-2026-106155

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.