Telerik Fiddler Classic: Weak signature verification of helper tools
Summary
Fiddler Classic for Windows checks only that a helper tool has a valid Authenticode signature from a broadly listed publisher, not that it is the expected executable. A local attacker with low privileges can replace a helper with another validly signed binary from an allow-listed publisher, which Fiddler then runs, including with Administrator rights for tools that request elevation. Exploitation also requires that the user launches the external tool and approves the UAC prompt without noticing the different executable.
Affected
- Telerik Fiddler Classic for Windows, versions 1.0.0 to before 6.0.20262.10021
- Default configuration: not affected unless external tools are used (Progress Software describes the default as unaffected)
Fixed in
- Upgrade to Telerik Fiddler Classic 6.0.20262.10021 or later
- No fix has been identified for older branches; do not assume earlier builds are fixed
Workaround
- Carefully check every UAC elevation prompt raised by Fiddler Classic and approve it only if it refers to the expected executable
- Do not launch external tools from Fiddler Classic, such as the Windows 8 Loopback Exemptions tool or the machine store certificate trust tool
Exploitation
- Vendor SSVC assessment: exploitation none, not automatable, total technical impact
- No active exploitation reported at the time of research
- No public proof of concept found
- Not listed in CISA KEV according to the research performed
- Reported by the NATO Cyber Security Centre
Our recommendation
- Inventory all Fiddler Classic installations, including versions and install paths
- Upgrade to 6.0.20262.10021 or later, preferably on developer, QA and admin workstations first
- Until upgraded, instruct users not to launch Fiddler external tools and to refuse any UAC prompt that does not match an expected file
- Check the licence position: the EULA limits Fiddler Classic to non-commercial use from August 3, 2026, and continued commercial use after September 17, 2026 is not supported
- Optionally verify the helper executables' hashes on high-value machines and look for unexpected binaries in Fiddler's tool directories
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik advisory CVE-2026-77805 (vendor knowledge base) www.telerik.com
- Telerik advisory CVE-2026-77805 (documentation mirror) docs.telerik.com
- Telerik Fiddler Classic release history www.telerik.com
- Telerik Fiddler licence agreement www.telerik.com
- Tenable plugin 364359 changelog www.tenable.com
- eSecurityPlanet news on CVE-2026-77805 www.esecurityplanet.com
- Mallory CVE-2026-77805 story mallory.ai
- Strix CVE-2026-77805 aggregator entry www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:36.
Original description (NVD)
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.