← Back to the live CVE advisory feed

CVE-2026-77805: Product identification pending

Severity

7.9 (HIGH)

Vendor

PROGRESS

Patch status

Unknown

Published

2026-10-05T13:16:54.740

Modified

2026-10-05T16:17:16.293

Why it matters

High-severity vulnerability requiring prioritized review.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.

Technical summary

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.

View the official NVD record for CVE-2026-77805

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.