CVE-2024-4358

9.8 criticalKEVEPSS 97%

Critical (9.8) in Progress Telerik Report Server. In CISA KEV since 2024-06-13. EPSS 97% chance of exploitation in the next 30 days.

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 97% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2024-06-13, due 2024-07-04
CWE: CWE-290
Published: 2024-05-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

telerik:report_server_2024

References

https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358

Check your stack JSON