Is CVE-2026-77805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77805 being exploited in the wild.

How severe is CVE-2026-77805?

High severity, with a CVSS score of 7.9, published 5 October 2026.

Which products and versions are affected?

Progress Telerik Fiddler Classic prior to v6.0.20262.10021.

How is CVE-2026-77805 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-77805?

Check whether you run Progress Telerik Fiddler Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77805: Progress Telerik Fiddler Classic weak signature verification

CVE-2026-77805 · Severity: high · CVSS 7.9 · Published 2026-10-05

Fiddler Classic is a debugging tool for network traffic inspection used by developers. The application launches external helper tools but only checks that they have a valid certificate from a broad list of publishers, rather than verifying they are the genuine Fiddler-supplied binaries. A local attacker can replace these tools with any other legitimately signed executable and trick the user into running it with Administrator privileges, leading to privilege escalation and malware execution.

Technologies: Progress Telerik Fiddler Classic. Vendors: Progress.

Quick answers

Is CVE-2026-77805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77805 being exploited in the wild.
How severe is CVE-2026-77805?: High severity, with a CVSS score of 7.9, published 5 October 2026.
Which products and versions are affected?: Progress Telerik Fiddler Classic prior to v6.0.20262.10021.
Is there a fix for CVE-2026-77805?: Yes: fixed in v6.0.20262.10021. Until then: Review UAC prompts when launching external tools through Fiddler Classic and verify they reference the expected executables; alternatively, disable or avoid using external helper tools such as the Windows 8 Loopback Exemptions tool or the machine store trust tool until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77805 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-77805?: Check whether you run Progress Telerik Fiddler Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: v6.0.20262.10021

Review UAC prompts when launching external tools through Fiddler Classic and verify they reference the expected executables; alternatively, disable or avoid using external helper tools such as the Windows 8 Loopback Exemptions tool or the machine store trust tool until upgrading.

Technical details

The vulnerability is improper verification of cryptographic signatures (CWE-347): Fiddler Classic accepts any executable signed by publishers in an allow list, rather than verifying file integrity or identity against the specific bundled versions. Attack requires local file system access, user launching the tool, and user approval of an elevation prompt. An attacker gains code execution at the privilege level of the approved tool, potentially Administrator-level.

Affected products

Progress Telerik Fiddler Classic prior to v6.0.20262.10021

Timeline

2026-10-05: disclosed

References

https://docs.telerik.com/fiddler/knowledge-base/kb-security-weak-executable-signature-verification-cve-2026-77805

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.