Vulnerability · Published Oct 9, 2026 · Assigned by ProgressSoftware

CVE-2026-106155Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers

High 8.9

In plain English

A high-severity cross-site scripting in Telerik Report Server from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)8.9High

Exploit odds (30 days)0.2%top 90.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	Telerik Report Server	0 – before 12.2.26.1007

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

References

https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-improper-neutralization-of-input-cve-2026-106155 vendor-advisory