# CVE-2026-124700: Telerik UI for WinForms untrusted URL redirection

Source: https://junglewise.ai/threats/cve-2026-124700-in-telerik-ui-for-winforms-versions-prior-to-2026-4-1111-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-124700 · Severity: high · CVSS 7.8 · Published 2026-11-12

Telerik UI for WinForms is a component library for building Windows desktop applications. A vulnerability allows attackers to hijack hyperlinks in documents to redirect users to malicious sites or trigger unintended system actions by launching arbitrary OS protocol handlers with attacker-controlled arguments when users open specially crafted documents.

Technologies: [Progress Telerik UI for WinForms](https://junglewise.ai/threats/technologies/telerik-ui-for-winforms). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-124700 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124700 being exploited in the wild.

**How severe is CVE-2026-124700?** High severity, with a CVSS score of 7.8, published 12 November 2026.

**Which products and versions are affected?** Progress Telerik UI for WinForms prior to 2026.4.1111.

**Is there a fix for CVE-2026-124700?** Yes: fixed in 2026.4.1111. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124700 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-124700?** Check whether you run Progress Telerik UI for WinForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.4.1111

## Technical details

An untrusted URL redirection vulnerability (CWE-601) in Telerik UI for WinForms versions prior to 2026.4.1111 allows attackers to craft documents with hyperlinks using non-allowlisted URI schemes that, when opened by a user, execute arbitrary operating system protocol handlers with attacker-supplied arguments. The attack requires user interaction to open a malicious document.

## Affected products

- Progress Telerik UI for WinForms prior to 2026.4.1111

## Timeline

- 2026-11-12: disclosed

## References

- [https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124700](https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124700)

## Related threats

- [Telerik UI for WinForms deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-124701-in-telerik-ui-for-winforms-versions-prior-to-2026-4-1111-a)
- [Telerik UI for WinForms code generation vulnerability](https://junglewise.ai/threats/cve-2026-124699-in-telerik-ui-for-winforms-versions-prior-to-2026-4-1111-an)