Serial number: AV26-1148
Date: November 12, 2026
As of November 12, 2026, Progress Software is affected by vulnerabilities in the following products:
- Telerik Report Server
- Prior to 12.3.26.1110
- Telerik Reporting
- Prior to 20.3.26.1110
- Telerik UI for ASP.NET Core
- Prior to 2026.3.1015
- Telerik UI for WPF
- Prior to 2026.4.1110
- Telerik UI for WinForms
- Prior to 2026.4.1111
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
- ClassFactory Race Condition and Retained Assembly Memory in Telerik UI for ASP.NET MVC (CVE-2026-106137)
- Deserialization of Untrusted Data in Telerik Reporting Report Designers (CVE-2026-106140)
- Telerik Report Server External Control of Configuration Setting in Telerik Report Server (CVE-2026-106152)
- Improper Control of Generation of Code Vulnerability (CVE-2026-124699)
- Improper Control of Generation of Code Vulnerability (CVE-2026-124703)
- Progress Trust Center