Weak Executable Signature Verification Vulnerability (CVE-2026-77805)

Description

August 2026 - CVE-2026-77805

• Progress® Telerik® Fiddler® Classic 2026 (6.0.20261.7291) or earlier.

What Are the Impacts

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a privilege escalation and execution of unintended code is possible by replacing one of the helper executables used by Fiddler with any other validly signed binary from an allow-listed publisher.

Issue

• CWE-347: Improper Verification of Cryptographic Signature.
• CAPEC-206: Signing Malicious Code.

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Follow the update instructions for precise instructions or download the latest version of Progress® Telerik® Fiddler® Classic from this link.

Mitigation

If an immediate upgrade is not possible, apply the following measures to reduce risk:

• Review UAC prompts when calling external tools and make sure they are for the expected files or do not run external tools from the Fiddler Classic application like the Windows 8 Loopback Exemptions tool or the machine store trust tool.

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank NATO Cyber Security Centre (NCSC) for responsibly disclosing this vulnerability.

External References

CVE-2026-77805 (HIGH)

CVSS: 7.9

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.

Discoverer Credit: NATO Cyber Security Centre (NCSC)