CVE-2026-124700
Received Received - Intake

Telerik UI for WinForms Untrusted URL Redirection

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Progress Software Corporation

Description
In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-124700
EUVD
EUVD-2026-124563

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Telerik UI for WinForms From 2026.3.1007 (inc) to 2026.4.1111 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In Telerik UI for WinForms versions before 2026.4.1111, there is an untrusted URL redirection flaw. Attackers can exploit this by creating malicious documents or hyperlinks with non-allowlisted URI schemes. When a user opens these, it can launch arbitrary OS protocol handlers with attacker-controlled arguments.

Detection Guidance

Check for applications using Telerik UI for WinForms versions prior to 2026.4.1111. Inspect network traffic for suspicious URI schemes or redirections. Review system logs for unexpected protocol handler launches.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary commands on your system if you open a crafted document or hyperlink. This may lead to unauthorized access, data theft, or further compromise of your system depending on the attacker's goals.

Mitigation Strategies

Update Telerik UI for WinForms to version 2026.4.1111 or later. Disable non-allowlisted URI schemes in application settings. Educate users to avoid opening untrusted links.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...