#telerik

Analysis · May 20, 2026 · Colten Anderson

There's no vendor to patch this one. The vulnerable code is inside an app you built.

CVE-2017-11357 is a file-upload-to-RCE flaw in the Telerik UI component. It's not a product on your network you can update; it's a library compiled into web apps your own team shipped, sometimes years ago, often without anyone remembering Telerik is in there.