Fiddler Classic Signature Verification Flaw Enables Code Execution and Potential Privilege Escalation

Progress patched a high-severity weak executable signature verification vulnerability, CVE-2026-77805, in Telerik Fiddler Classic for Windows. Versions before 6.0.20262.10021 allow a low-privileged local attacker to substitute an external helper executable because the application accepts valid Authenticode signatures from broadly allow-listed publishers without confirming that the executable is the specific helper shipped with the product. The flaw, responsibly disclosed by the NATO Cyber Security Centre, has a reported CVSS score of 7.9.

Exploitation requires a user to launch the substituted helper; potential privilege escalation additionally requires the user to approve its elevation prompt without noticing the executable mismatch. Progress recommends upgrading to 6.0.20262.10021. Users unable to upgrade should scrutinize external-tool User Account Control prompts or avoid launching external tools from Fiddler Classic. The Canadian Centre for Cyber Security issued advisory AV26-999, urging users and administrators to review vendor guidance and apply updates; its notice did not state whether exploitation had been observed.