CVE-2024-7292 is a high severity (CVSS 7.5) flaw in Progress Telerik Report Server. The product does not restrict excessive login attempts, so credential stuffing against its login page is possible. Upgrade to 2024 Q3 (10.2.24.806) or later, and review login activity.
What's affected
The record describes versions prior to 2024 Q3 (10.2.24.806). Telerik's own knowledge base article is more specific: it lists Report Server 2024 Q3 (10.2.24.709) and earlier as affected, with the fix in 2024 Q3 (10.2.24.806). The two statements agree. The article gives the severity as 7.5 HIGH, matching the record.
The weakness is CWE-307, improper restriction of excessive authentication attempts. The vector is AV:N/AC:H/PR:N/UI:R. The high attack complexity and user interaction values explain why the score stops at 7.5 even though the potential confidentiality, integrity and availability impact is rated high.
Telerik lists no workaround in the article.
How to check if you're exposed
Telerik documents how to read your version. Sign in as an administrator, open the Configuration page at the path ~/Configuration/Index on your server, and select the About tab. If the build is 10.2.24.709 or older, you are in the affected range.
Then look at your logs for the symptom. Credential stuffing shows up as many failed sign ins from one source, or one source trying many different usernames, over a short period. Report Server sits behind IIS in most deployments, so IIS and application logs are the place to start.
What to do now
- Download 2024 Q3 (10.2.24.806) from the Product Downloads page of your Telerik account. A Report Server license is required.
- Follow the upgrade instructions in the Implementer Guide.
- Until you have upgraded, put the login page behind a network control you manage, such as a reverse proxy with rate limiting, an allow list, or a VPN. This is a general precaution and not a Telerik recommendation.
- Turn on multi factor or single sign on at your identity layer if your deployment allows it.
- Force a password reset for accounts that appear in suspicious login activity.
- Apply the companion fix for CVE-2024-7293 at the same time, since both are resolved in the same build.
Why it matters
Credential stuffing works because people reuse passwords. Attackers take username and password pairs leaked from other services and try them at scale. Without lockout, delay or rate limits, the login form lets them do that cheaply and quietly.
A report server often holds connection strings, data source credentials and business reports. A successful sign in can expose all of that. Neither Telerik nor the record says this flaw is exploited in the wild, and it is not marked as a CISA Known Exploited Vulnerability.
If you keep a software inventory, the free scan at gold.safeguard.sh/scan can flag .NET dependencies in your own projects, though a deployed server product like this one needs to be tracked as an asset in its own right.
Quick check
Is there a configuration setting that fixes this without upgrading?
Telerik lists no workaround. The supported fix is the 2024 Q3 (10.2.24.806) upgrade.
Which version is the first safe one?
According to the Telerik article, 2024 Q3 (10.2.24.806).
Sources
Last reviewed: 19 October 2026.
