Telerik Report Server EUVD-2026-95523

Requires an authenticated session with a valid bearer token against Progress Telerik Report Server (versions prior to 12.2.26.1007) - notably, the vendor states even a low-privilege or guest account suffices, so this is NOT an admin-only flaw. The attacker must reach the service-agent SignalR hub over the network and register as a service agent. The key limiting factor is timing: protected secrets (storage settings and encryption private keys) are only delivered to the rogue agent on the NEXT server settings-synchronization event, so the attacker must persist until that synchronization occurs. There is no user-interaction requirement and no non-default configuration is described as necessary beyond the existence of a usable account.

This is a credible, actionable priority rather than a CVSS-inflated non-issue, but it sits below the top tier. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms a network-reachable, low-complexity attack requiring only authentication - and critically, the description clarifies that even a low-privilege or guest account with a valid bearer token qualifies, which effectively lowers the practical bar of PR:L to near-trivial in any deployment that permits self-registration or weak guest accounts. The high score driver is C:H: disclosure of storage encryption private keys and stored data-source credentials/connection strings, which is a serious secondary-exploitation enabler (harvested DB credentials can pivot into back-end data stores). I:L reflects agent impersonation and task-dispatch interference; A:N is vendor-assigned, though the described 'interference with task dispatch' arguably supports a minor availability impact (see assessed vector note). No EPSS score, KEV listing, or POC was provided in the input, so real-world exploitation signal is currently absent - the only reference is the vendor's own advisory. There is one timing dependency that tempers urgency: secret disclosure only occurs on the NEXT server settings-synchronization event, so exploitation is not instantaneous. Net: patch promptly given the sensitivity of the leaked material and low attack complexity, but there is no evidence of active exploitation at this time.

An attacker who holds any valid Report Server account - even a low-privilege or guest account with a bearer token - connects to the service-agent SignalR hub and registers itself as a trusted service agent. When the server next performs its settings-synchronization, it pushes storage settings and encryption private keys to the rogue agent, handing the attacker the keys needed to decrypt stored data-source credentials and connection strings. No public exploit identified at time of analysis.