CVE-2026-106140— Deserialization of Untrusted Data in Telerik Reporting Report Designers

Quick assessment

Affected

Progress Software Telerik Reporting

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 20.3.26.1110 之前的 In Progress® Telerik® Reporting 产品中，.NET Framework 报表设计器存在一个不可信数据反序列化漏洞。当用户执行某些编辑操作时，该漏洞允许拥有低权限的本地攻击者在设计器进程的上下文中执行任意代码。

CVSS 7.3 · High Updated Nov 12, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Deserialization of Untrusted Data in Telerik Reporting Report Designers

Source: CVE Program / CVE List V5

Vulnerability Description

In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Progress Software	Telerik Reporting	0 ~ 20.3.26.1110	-

II. Public POCs for CVE-2026-106140

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-106140

请登录查看更多情报信息。

Other References for CVE-2026-106140 (1)

https://www.telerik.com/products/reporting/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-106140 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-106140

Same Patch Batch · Progress Software · 2026-11-12 · 7 CVEs total

CVE-2026-124699	7.8 HIGH	Improper Control of Generation of Code in Progress Telerik UI for WinForms
CVE-2026-124701	7.8 HIGH	Deserialization of Untrusted Data in Progress Telerik UI for WinForms
CVE-2026-124704	7.8 HIGH	Deserialization of Untrusted Data in Progress Telerik UI for WPF
CVE-2026-124703	7.8 HIGH	Improper Control of Generation of Code in Progress Telerik UI for WPF
CVE-2026-124705	7.8 HIGH	URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI
CVE-2026-118975	6.5 MEDIUM	XML External Entity (XXE) Injection in Telerik Reporting SVG Processing

IV. Related Vulnerabilities

Same product: Telerik Reporting

Same vendor: Progress Software

Same weakness: CWE-502