# CVE-2026-77804: Progress Telerik Fiddler Classic TOCTOU race condition in certificate installation

Source: https://junglewise.ai/threats/cve-2026-77804-in-progress-telerik-fiddler-classic-for-windows-versions-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-77804 · Severity: medium · CVSS 6.6 · Published 2026-10-05

Fiddler Classic is a web debugging proxy tool used by developers to inspect and modify network traffic. A race condition in the HTTPS certificate installation process allows a local attacker to substitute an attacker-controlled root certificate into the system's trusted certificate store, enabling them to intercept and decrypt encrypted traffic on the affected computer. Exploitation requires user interaction to initiate the certificate trust operation and approve a system elevation prompt.

Technologies: [Progress Telerik Fiddler Classic](https://junglewise.ai/threats/technologies/telerik-fiddler-classic). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-77804 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77804 being exploited in the wild.

**How severe is CVE-2026-77804?** Medium severity, with a CVSS score of 6.6, published 5 October 2026.

**Which products and versions are affected?** Progress Telerik Fiddler Classic prior to v6.0.20262.10021.

**Is there a fix for CVE-2026-77804?** Yes: fixed in v6.0.20262.10021. Until then: Only trust the Fiddler certificate in the current user store rather than the local machine store. If local machine certificate installation is necessary, manually export the certificate to a file and import it through Windows certificate management utilities rather than using Fiddler's automated installation.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-05"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77804 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-77804?** Check whether you run Progress Telerik Fiddler Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v6.0.20262.10021

Only trust the Fiddler certificate in the current user store rather than the local machine store. If local machine certificate installation is necessary, manually export the certificate to a file and import it through Windows certificate management utilities rather than using Fiddler's automated installation.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-05"}]

## Technical details

A time-of-check time-of-use (TOCTOU) race condition exists in the HTTPS interception root certificate installation flow. Fiddler writes the certificate to a temporary file in a user-writable location, then launches an elevated TrustCert helper application to import it from that file. A local attacker can replace the temporary file between write and read, causing an arbitrary root certificate to be installed in the Local Computer Trusted Root Certification Authorities store. This requires the user to initiate certificate trust and approve elevation.

## Affected products

- Progress Telerik Fiddler Classic prior to v6.0.20262.10021

## References

- [https://docs.telerik.com/fiddler/knowledge-base/kb-security-root-certificate-installation-toctou-cve-2026-77804](https://docs.telerik.com/fiddler/knowledge-base/kb-security-root-certificate-installation-toctou-cve-2026-77804)

## Related threats

- [Progress Telerik Fiddler Classic weak signature verification](https://junglewise.ai/threats/cve-2026-77805-in-progress-telerik-fiddler-classic-for-windows-versions-prior-to)
- [Progress Telerik Fiddler Classic HTTP request smuggling](https://junglewise.ai/threats/cve-2026-77802-in-progress-telerik-fiddler-classic-for-windows-versions-prior-to)