CVE-2024-1800 is a critical (CVSS 9.9) insecure deserialization flaw in Progress Telerik Report Server that allows remote code execution. Versions before 2024 Q1 (10.0.24.130) are affected. Progress says updating to 2024 Q1 (10.0.24.305) or higher is the only way to remove the vulnerability.
What's affected
Progress Telerik Report Server 2024 Q1 (10.0.24.130) and older. The record says versions prior to 2024 Q1 (10.0.24.130) are affected.
The fix is a version upgrade. Progress's knowledge base article says that updating to Report Server 2024 Q1 (10.0.24.305) or higher is the only way to remove the vulnerability. Note the build numbers: 10.0.24.130 is the last vulnerable build named, and 10.0.24.305 is the first build Progress names as the fix.
The weakness is CWE-502, deserialization of untrusted data. The advisory credits the finding to a researcher working through HackerOne with the Trend Micro Zero Day Initiative, and I am not naming further details because the page gives none.
The CVSS 9.9 score comes from the record. The vendor page that I retrieved gives no separate score.
How to check if you're exposed
Report Server is a web application, so first find out where it runs and which version it is.
In the Report Server web interface, the version appears in the About or footer area of the admin pages. On the server, check the installed programs list on Windows:
Get-Package -Name "*Report Server*" | Select-Object Name, Version
If that returns nothing, open Settings, Apps, Installed apps and look for Telerik Report Server. Compare the version against 10.0.24.305.
Also ask who can reach the server. A report server exposed to the internet is a far higher priority than one limited to an internal network, though the score here assumes network access.
What to do now
- Inventory every Report Server instance, including test and forgotten ones.
- Back up the Report Server database and configuration, then upgrade to 2024 Q1 (10.0.24.305) or higher by following the Progress upgrade steps in your account downloads.
- Until the upgrade is done, restrict network access to the server to the people and systems that need it.
- Review the server for unexpected accounts, scheduled tasks and new files created around the time of any suspected exposure.
- Check the sibling issue CVE-2024-1801 and CVE-2024-1856 if you also embed Telerik Reporting in your own applications.
Why it matters
Insecure deserialization means an application rebuilds objects from data it does not fully control, and the rebuilding step can be made to run attacker chosen code. In .NET, some types execute logic during that process. If a server accepts such data from a user, the user can steer what runs.
The result here is remote code execution, which is why the score sits close to the maximum of 10. A server running Report Server often has access to databases that feed reports, so the reach after a compromise can extend well beyond the box itself.
The record's CISA Known Exploited Vulnerabilities flag is false, and the Progress page I retrieved does not report active exploitation. That can change, so check the CISA catalog directly if your risk process depends on it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is upgrading really the only fix?
Progress says so on its knowledge base page. It names 2024 Q1 (10.0.24.305) or higher as the version that removes the vulnerability.
What is the difference from the Telerik Reporting CVEs?
Report Server is the standalone product. CVE-2024-1801 and CVE-2024-1856 affect the Telerik Reporting library, with a separate fixed version of 18.0.24.305.
Sources
Last reviewed: 19 October 2026.
