CVE-2024-1801 is a high severity (CVSS 7.7) insecure deserialization flaw in Progress Telerik Reporting. A local attacker can run code. Versions before 2024 Q1 (18.0.24.130) are affected, and Progress says updating to 2024 Q1 (18.0.24.305) or later is the only way to remove it.
What's affected
Progress Telerik Reporting 2024 Q1 (18.0.24.130) and older. The record says versions prior to 2024 Q1 (18.0.24.130) are affected.
Progress's knowledge base article covers CVE-2024-1801 and CVE-2024-1856 together. It says that updating to at least Reporting 2024 Q1 (18.0.24.305) is the only way to remove the vulnerability. As with Report Server, 18.0.24.130 is the last vulnerable build named and 18.0.24.305 is the first fixed build named.
The weakness is CWE-502, deserialization of untrusted data. The record describes this variant as a code execution attack by a local threat actor, so the attacker needs local access or a way to feed data to the application on the host. A sibling issue, CVE-2024-1856, covers a remote variant and has its own post.
Because the record calls this the local variant, it is less urgent than CVE-2024-1856, but both are fixed by the same upgrade, so there is no reason to treat them separately.
How to check if you're exposed
Telerik Reporting is a library that ships inside your own application, so the version sits in your dependencies. The Progress article gives two ways to read it.
If your application exposes the Reporting REST service, the version is available at the /api/reports/version/ endpoint of that service. If you only use the desktop tooling, open Settings, Apps, Installed apps on the machine and expand the Telerik Reporting item.
For code projects, search your NuGet references:
dotnet list package | findstr /i Telerik.Reporting
grep -ri "Telerik.Reporting" --include=*.csproj .
Check every solution that builds reports, including internal tools. These libraries get copied into many projects and tend to stay on old versions.
What to do now
- List every project that references Telerik Reporting and note the version.
- Upgrade to 2024 Q1 (18.0.24.305) or later by following the Telerik Reporting upgrade documentation for your starting version.
- Rebuild and redeploy each application that bundles the library.
- Review the web configuration of any app that exposes the Reporting REST service and keep it off untrusted networks until it is patched.
- Re-scan afterwards to confirm no old copy of the library remains in build outputs or container images.
Why it matters
The same root cause, deserialization of untrusted data, sits behind both Telerik Reporting CVEs. The difference is who can reach the vulnerable path. Here the record says a local threat actor can do it, which fits a desktop tool or a service where an attacker already has a foothold.
Local flaws matter because attackers chain them. A low privilege foothold from phishing or a different bug can become full code execution if a vulnerable component sits on the same machine. The score of 7.7 reflects high impact with a more constrained attack path.
The Known Exploited Vulnerabilities flag in the record is false, and the Progress page does not report exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does CVE-2024-1801 need network access?
The record calls it a local variant. The remote variant is CVE-2024-1856, fixed in the same release.
Which version fixes it?
Progress names Reporting 2024 Q1 (18.0.24.305) or higher.
Sources
Last reviewed: 19 October 2026.
