CVE-2026-124701— Deserialization of Untrusted Data in Progress Telerik UI for WinForms

Quick assessment

Affected

Progress Software Telerik UI for WinForms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Telerik UI for WinForms 2026.4.1111 之前的版本中，存在一个不可信数据反序列化漏洞，该漏洞允许攻击者在受影响应用程序的上下文中执行未经授权的操。

CVSS 7.8 · High Updated Nov 12, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Deserialization of Untrusted Data in Progress Telerik UI for WinForms

Source: CVE Program / CVE List V5

Vulnerability Description

In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Progress Software	Telerik UI for WinForms	2026.3.1007 ~ 2026.4.1111	-

II. Public POCs for CVE-2026-124701

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124701

请登录查看更多情报信息。

Other References for CVE-2026-124701 (1)

https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124701 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124701

Same Patch Batch · Progress Software · 2026-11-12 · 7 CVEs total

CVE-2026-124699	7.8 HIGH	Improper Control of Generation of Code in Progress Telerik UI for WinForms
CVE-2026-124704	7.8 HIGH	Deserialization of Untrusted Data in Progress Telerik UI for WPF
CVE-2026-124703	7.8 HIGH	Improper Control of Generation of Code in Progress Telerik UI for WPF
CVE-2026-124705	7.8 HIGH	URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI
CVE-2026-106140	7.3 HIGH	Deserialization of Untrusted Data in Telerik Reporting Report Designers
CVE-2026-118975	6.5 MEDIUM	XML External Entity (XXE) Injection in Telerik Reporting SVG Processing

IV. Related Vulnerabilities

Same product: Telerik UI for WinForms

Same vendor: Progress Software

Same weakness: CWE-502