An unauthenticated remote user can influence the server address that Report Server uses for links and notifications.Telerik says user interaction can turn that influence into sensitive information disclosure or account takeover. The issue affects Report Server before 12.3.26.1110, while embedded Telerik Reporting is not affected.
What it allows
How Does CVE-2026-106152 Change Report Server Links?
Telerik says the flaw lets an unauthenticated remote user influence the server address used to generate links and notifications. The server can therefore produce links using an address that an outside party influenced.
User interaction is a separate step in Telerik’s stated impact. The advisory says this path can disclose sensitive information or lead to account takeover, but it does not identify a specific link type or user action.
Our reading is that the address configuration is the trust boundary in this issue. That assessment follows Telerik’s description of externally influenced output, rather than a published account of a particular incident.
What Is Known About Exploitation?
CISA KEV catalog version 2026.11.10 did not list CVE-2026-106152. A dated catalog status cannot settle whether the flaw has been used in other environments.
Telerik describes a possible impact, not a confirmed compromise. We therefore mark exploitation unknown and do not treat the CVSS score as evidence of observed attacks.
Who is affected
Which Telerik Report Server Versions Are Affected?
Telerik lists Report Server versions from 0 up to, but excluding, 12.3.26.1110. Its advisory explicitly says embedded Telerik Reporting is not affected by this CVE.
The fix is Report Server 12.3.26.1110 or later. Administrators should compare each installed server version with that boundary before closing the update task.
Why Does the Server Address Matter?
Report Server uses its configured address when it creates links and notifications. If that address is influenced externally, a user may receive a link that does not point where the administrator intended.
Telerik connects this behavior to possible information disclosure and account takeover after user interaction. Brandefense Blackhole counted one Telegram dark-chat post mentioning this CVE between August 13 and November 11, 2026.
That single mention shows discussion, not exploitation. Our assessment is to prioritize exposed Report Server installations because the attack requires no account and the stated impact involves users and sensitive information.
What Should Administrators Verify After Updating?
Upgrade affected Report Server deployments to version 12.3.26.1110 or later. Telerik then advises checking that Server URL contains the correct public server address and setting it explicitly if needed.
As a Brandefense precaution, inventory instances and review generated links and notification behavior during validation. Use the vulnerability management guide to track the rollout and the patch management glossary to plan verification.
The account takeover glossary explains the stated consequence. The security misconfiguration glossary provides context for why a server address setting needs review.
Timeline
- 2026-11-10
CISA KEV catalog version 2026.11.10 did not list CVE-2026-106152.
- 2026-11-11
NVD published the Progress CNA record; Telerik updated its advisory.
What to do
-
Identify affected Report Server installations
Inventory Progress Telerik Report Server installations and compare their versions with 12.3.26.1110. Embedded Telerik Reporting is outside this advisory’s affected product.
-
Upgrade to the fixed version
Install Telerik Report Server 12.3.26.1110 or later, following the vendor’s upgrade instructions.
-
Verify Server URL after the upgrade
Check that Server URL contains the correct public address of the Report Server. Set the value explicitly if the current value is wrong.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-106152?
It is a Telerik Report Server configuration setting flaw. An unauthenticated remote user may influence the server address used to generate links and notifications.
Does CVE-2026-106152 affect embedded Telerik Reporting?
Telerik says embedded Telerik Reporting is not affected. The advisory identifies Progress Telerik Report Server versions before 12.3.26.1110.
Which version fixes CVE-2026-106152?
Telerik says the issue is fixed in Report Server 12.3.26.1110. It recommends upgrading to that version or later.
Is user interaction required for the stated impact?
Yes. Telerik says sensitive information disclosure or account takeover can follow with user interaction. Its advisory does not identify the exact action required.
Is CVE-2026-106152 in CISA KEV?
CISA KEV catalog version 2026.11.10 did not list this CVE. That dated status does not determine whether exploitation has occurred elsewhere.
Sources
- External Control of Configuration Setting in Telerik Report Server (CVE-2026-106152)Progress Telerik
- CVE-2026-106152 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
