Progress Telerik Report Server vulnerabilities

7 CVEs affecting Progress Telerik Report Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0556, published 2025-02-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-1800, published 2024-03-20. High severity, CVSS 8.8. EPSS: 40.4% chance of exploitation in the next 30 days. In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.
CVE-2024-6327, published 2024-07-24. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.
CVE-2024-8015, published 2024-10-09. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
CVE-2024-4837, published 2024-05-15. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary…
CVE-2024-7292, published 2024-10-09. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.
CVE-2025-0556, published 2025-02-12. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent…
CVE-2024-7295, published 2024-11-13. Medium severity, CVSS 6.2. EPSS: 0.1% chance of exploitation in the next 30 days. In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this…