# CVE-2026-124703: Telerik UI for WPF improper code generation vulnerability

Source: https://junglewise.ai/threats/cve-2026-124703-in-telerik-ui-for-wpf-versions-prior-to-2026-4-1110-an-improper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-124703 · Severity: high · CVSS 7.8 · Published 2026-11-12

Telerik UI for WPF is a framework for building Windows desktop applications. A flaw in code generation allows attackers to execute unauthorized code within the context of any application built with vulnerable versions, potentially leading to full application compromise and data theft.

Technologies: [Progress Telerik UI for WPF](https://junglewise.ai/threats/technologies/telerik-ui-for-wpf). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-124703 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124703 being exploited in the wild.

**How severe is CVE-2026-124703?** High severity, with a CVSS score of 7.8, published 12 November 2026.

**Which products and versions are affected?** Progress Telerik UI for WPF prior to 2026.4.1110.

**Is there a fix for CVE-2026-124703?** Yes: fixed in 2026.4.1110. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124703 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-124703?** Check whether you run Progress Telerik UI for WPF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.4.1110

## Technical details

An improper control of code generation vulnerability (CWE-94) in Telerik UI for WPF versions prior to 2026.4.1110 enables code injection (CAPEC-242). The vulnerability allows arbitrary code execution in the affected application's context; the attack vector and preconditions are not detailed in the advisory, but the high CVSS score suggests network accessibility or low user interaction requirements.

## Affected products

- Progress Telerik UI for WPF prior to 2026.4.1110

## Timeline

- 2026-11-12: disclosed

## References

- [https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124703](https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124703)

## Related threats

- [Progress Telerik UI for WPF untrusted URL redirection](https://junglewise.ai/threats/cve-2026-124702-in-telerik-ui-for-wpf-versions-prior-to-2026-4-1110-an-untrusted)
- [Telerik UI for WPF deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-124704-in-telerik-ui-for-wpf-versions-prior-to-2026-4-1110-a)