Is CVE-2026-65688 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65688 being exploited in the wild.

How severe is CVE-2026-65688?

Critical severity, with a CVSS score of 9.8, published 23 July 2026.

Which products and versions are affected?

Syncfusion Standalone Report Designer < 14.1.12.

Is there a fix for CVE-2026-65688?

A patch was published on 2026-07-20: Vendor released version 14.1.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65688 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-65688?

Check whether you run Syncfusion Standalone Report Designer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65688: Bold Reports Standalone Report Designer path traversal in font processing

Q: Is there a fix for CVE-2026-65688?

A patch was published on 2026-07-20: Vendor released version 14.1.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65688 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-65688?

Check whether you run Syncfusion Standalone Report Designer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65688 · Severity: critical · CVSS 9.8 · Published 2026-07-23

Bold Reports Standalone Report Designer, a tool used for creating and managing business reports, contains a security flaw in how it handles font files. An unauthenticated attacker can exploit this to read sensitive files directly from the server's filesystem, such as configuration files or login credentials. This could lead to a total compromise of the reporting server and unauthorized access to corporate data.

Technologies: Syncfusion Standalone Report Designer. Vendors: Syncfusion.

Quick answers

Is CVE-2026-65688 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65688 being exploited in the wild.
How severe is CVE-2026-65688?: Critical severity, with a CVSS score of 9.8, published 23 July 2026.
Which products and versions are affected?: Syncfusion Standalone Report Designer < 14.1.12.
Is there a fix for CVE-2026-65688?: A patch was published on 2026-07-20: Vendor released version 14.1.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65688 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-65688?: Check whether you run Syncfusion Standalone Report Designer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the font processing feature of Bold Reports Standalone Report Designer due to insufficient validation of user-supplied file paths. An unauthenticated remote attacker can exploit this by sending a specially crafted network request to the server. Successful exploitation allows the attacker to read arbitrary files from the underlying host filesystem. This can result in the disclosure of sensitive information, including application credentials, which may facilitate further unauthorized access or full system compromise. The issue is resolved in version 14.1.12.

Affected products

Bold Reports (By Syncfusion) Standalone Report Designer < 14.1.12

Timeline

2026-07-20: patched: Vendor released version 14.1.12
2026-07-23: disclosed: CVE-2026-65688 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.