What’s Vulnerable › Vulnerabilities

CVE-2024-4358: Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-06-13
• EPSS: 97.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-05-29 · updated 2026-06-17
• Weakness: CWE-290

Description

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Affected products

• Telerik Report Server 2024: through 10.0.24.305

References

• https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
• https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358

Get alerted when CVE-2024-4358 or the next vulnerability affects your stack