CVE-2024-4358

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.975 · 100 %ileexploit · weaponizedDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 9 exploits · weaponized

Likely / severe?

97.5% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

5 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2024-06-13remediate by 2024-07-04

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-22

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · security@progress.comexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-290USprimaryCWE-290US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

T1190Exploit Public-Facing Application — CVE-2024-4358 is an authentication bypass vulnerability. This has been seen to be chained with CVE-2024-1800 in order to achieve remote code execution.exploitation

exploits (9)

Public proof-of-concept and weaponised exploit code.

exploit/windows/http/telerik_report_server_deserializationTelerik Report Server Auth Bypass and Deserialization RCEweaponized · metasploit
auxiliary/scanner/http/telerik_report_server_auth_bypassTelerik Report Server Auth Bypassfunctional · metasploit
EDB-52103Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication BypassPoC · exploit_db
Harydhk7/CVE-2024-4358Harydhk7/CVE-2024-4358PoC · poc_in_github
RevoltSecurities/CVE-2024-4358An Vulnerability detection and Exploitation tool for CVE-2024-4358PoC · poc_in_github
Sk1dr0wz/CVE-2024-4358_Mass_ExploitSk1dr0wz/CVE-2024-4358_Mass_ExploitPoC · poc_in_github

affected products (5)

Products and version ranges known to be affected.

Progress Software Telerik Report Server <10.1.24.514all versionscert_bundDE
Progress Software Telerik Report Server< 10.1.24.514cert_bundDE
Progress Software Corporation Telerik Report Server1.0.0 → 10.1.24.514enisa_euvdEU
Progress Software Corporation Telerik Report Server≤ 2024 Q1 (10.0.24.305)fstec_bduRU
telerik report server 2024≤ 10.0.24.305nvdUScpe:2.3:a:telerik:report_server_2024:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-3158Progress Software Telerik Report Server: Mehrere SchwachstellenDeutsch2024-10-13csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Progress Software Telerik Report Server ausnutzen, um Informationen offenzulegen, beliebigen Code auszuführen oder die Authentifizierung zu umgehen.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2024-05-29modified 2026-06-17

related (886)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-102764US	critical9.8OT critical	1.18% (67th)	KEV	2026-10-15
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Unde…
CVE-2026-104935US	—OT critical	26.0% (98th)	KEV	2026-10-13
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14…
CVE-2024-54085US	critical9.8OT critical	60.7% (99th)	KEV	2025-03-11
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerabili…
CVE-2023-50224US	—OT critical	20.0% (97th)	KEV	2024-05-03
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information o…
CVE-2022-26925US	medium5.9OT critical	10.5% (96th)	KEV	2022-05-10
Windows LSA Spoofing Vulnerability

+881 more

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan