---
id: "CVE-2024-4358"
kind: "vulnerability"
aliases: ["CVE-2024-4358"]
title: "telerik report server 2024: In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Progress Telerik Report Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "telerik report server 2024", "fixed": [], "affected": "<= 10.0.24.305", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "package", "self-hosted", "telerik-report-server"]
not_affected_if: ["unknown"]
published_at: "2024-05-29T15:16:06+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4358", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4358", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# telerik report server 2024: In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can…

Progress Telerik Report Server has an authentication bypass that lets an attacker gain unauthorized access by spoofing. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Progress Telerik Report Server affected ? fixed ?
- vendor:telerik report server 2024 affected <= 10.0.24.305 fixed ?

## Fix

Apply the mitigations per the vendor instructions, or discontinue use of the product if mitigations are unavailable.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4358
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-4358

## From the sources

Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_