{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77805", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-08-21T13:37:36.679Z", "datePublished": "2026-10-05T12:40:57.524Z", "dateUpdated": "2026-10-05T12:40:57.524Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-10-05T12:40:57.524Z"}, "title": "Weak Executable Signature Verification Vulnerability in Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-206", "descriptions": [{"lang": "en", "value": "CAPEC-206 Signing Malicious Code"}]}], "affected": [{"vendor": "Progress Software", "product": "Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "6.0.20262.10021", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable."}]}], "references": [{"url": "https://docs.telerik.com/fiddler/knowledge-base/kb-security-weak-executable-signature-verification-cve-2026-77805", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.9, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"}}], "workarounds": [{"lang": "en", "value": "Carefully review every User Account Control elevation prompt raised by Fiddler Classic and confirm that it refers to the expected executable before approving it. Alternatively, avoid launching external tools from the Fiddler Classic application, such as the Windows 8 Loopback Exemptions tool or the machine store certificate trust tool.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Carefully review every User Account Control elevation prompt raised by Fiddler Classic and confirm that it refers to the expected executable before approving it. Alternatively, avoid launching external tools from the Fiddler Classic application, such as the <b>Windows 8 Loopback Exemptions</b> tool or the machine store certificate trust tool.</div>"}]}], "credits": [{"lang": "en", "value": "NATO Cyber Security Centre (NCSC)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic", "vendor": "Progress Software", "versions": [{"lessThan": "6.0.20262.10021", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}], "source": "security@progress.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable."}], "id": "CVE-2026-77805", "lastModified": "2026-10-05T13:16:54.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 5.8, "source": "security@progress.com", "type": "Secondary"}]}, "published": "2026-10-05T13:16:54.740", "references": [{"source": "security@progress.com", "url": "https://docs.telerik.com/fiddler/knowledge-base/kb-security-weak-executable-signature-verification-cve-2026-77805"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security@progress.com", "type": "Primary"}]}

{}

{}