CVE-2024-4358: Progress Telerik Report Server authentication bypass, actively exploited
The short version: CVE-2024-4358 is an authentication-bypass flaw in Progress Telerik Report Server (2024 Q1 / 10.0.24.305 and earlier, on IIS). An unauthenticated attacker can spoof their way past authentication and reach restricted functionality — including registering a new administrator account — and researchers chained it with a deserialization bug (CVE-2024-1800) to achieve remote code execution. It's confirmed exploited and in CISA's KEV catalog. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — bypass to admin, chained to RCE (see below) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~97.48% · 99.89th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2024-07-04 |
| Known exploited? | Yes — CISA confirmed active exploitation |
| Vulnerability type | CWE-290 authentication bypass by spoofing → unauthorized access to restricted functionality (chainable to RCE) |
| Requires authenticated session? | No — pre-authentication |
| Affected | Telerik Report Server 2024 Q1 (10.0.24.305) and earlier, on IIS |
| Fixed in | Telerik Report Server 2024 Q2 (10.1.24.514) and later |
What you need to know
Telerik Report Server is a reporting platform typically hosted on IIS. CVE-2024-4358 is an authentication bypass by spoofing: an unauthenticated attacker can reach a registration/setup path that should have been gated, letting them create an administrator account and access restricted functionality.
Why it matters more than a lone bypass:
- Bypass becomes admin. Reaching restricted functionality unauthenticated lets an attacker stand up their own privileged account.
- It's been chained to RCE. Public tooling chains CVE-2024-4358 with the deserialization flaw CVE-2024-1800 to achieve remote code execution against the server.
- It's confirmed exploited, KEV-listed, and carries a very high EPSS — the theoretical is operational.
How serious we see it
Critical — in practice.
NVD scores it 9.8. We rate the real-world exposure High: it's an unauthenticated bypass on an application server (not an edge security appliance), but it hands over administrative access and has a public path to full remote code execution — a serious combination that's confirmed exploited. The bounded, reassuring part: Progress provides no workaround, but a single upgrade (2024 Q2 / 10.1.24.514) fully resolves it, and exposure is quick to determine.
Recommendations
Straight from Progress's advisory and CISA:
- Upgrade now. Move to Telerik Report Server 2024 Q2 (10.1.24.514) or later — there is no workaround.
- Reduce exposure. Keep Report Server off the public internet where possible; restrict access to trusted networks.
- Hunt. Review for unexpected administrator accounts created via the registration path, and for signs of the CVE-2024-4358 → CVE-2024-1800 RCE chain.
- If compromised, respond. Remove rogue accounts, rebuild where warranted, and rotate credentials and secrets.
- Confirm your exposure first. Verify whether you run an affected Report Server version on IIS that's reachable.
How BreachRisk sees it
BreachRisk discovers internet-facing Telerik Report Server instances from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one so it rises to the top of your results.
That continuous, outside-in view is the point: an exposed reporting server is already mapped and version-fingerprinted, so when an auth-bypass-to-RCE chain breaks you can go straight to upgrade-and-verify.