CVE-2026-77804: Telerik Fiddler Classic TOCTOU Vulnerability

CVE-2026-77804 Overview

CVE-2026-77804 is a time-of-check time-of-use (TOCTOU) race condition in Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021. The flaw affects the installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary file in a user-writable location, then invokes the external TrustCert helper, which elevates and imports it. A local low-privileged attacker who swaps the temporary file between the write and read operations can install an attacker-controlled root certificate into the Trusted Root Certification Authorities store. This enables interception and modification of TLS-protected traffic on the host.

Critical Impact
Successful exploitation installs an attacker-supplied root CA into the Local Computer trust store, enabling machine-wide TLS interception and tampering.

Affected Products

Progress Telerik Fiddler Classic for Windows, versions prior to v6.0.20262.10021
Windows installations where a user initiates the HTTPS certificate trust operation
Systems where the TrustCert helper runs with elevated privileges

Discovery Timeline

2026-10-05 - CVE-2026-77804 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-77804

Vulnerability Analysis

The vulnerability is a classic TOCTOU race condition [CWE-367] in the certificate trust workflow of Telerik Fiddler Classic. When a user chooses to trust Fiddler's HTTPS interception root certificate, the application serializes the certificate to a temporary file in a location writable by the current user. Fiddler then launches the TrustCert helper, which requests elevation through a User Account Control (UAC) prompt and imports the certificate from the referenced path into the Local Computer Trusted Root Certification Authorities store.

Between the write operation performed by Fiddler and the read operation performed by the elevated helper, the file is unprotected. A local attacker running under the same user context can replace the temporary file with an arbitrary certificate before the helper reads it. The elevated process then imports the attacker-controlled certificate without re-validating its origin.

Once the malicious root certificate is installed system-wide, the attacker can issue trusted certificates for arbitrary domains. This enables transparent interception, decryption, and modification of TLS traffic on the compromised host.

Root Cause

The root cause is the use of a user-writable staging location for a security-sensitive artifact that is later consumed by a privileged process. The elevated helper trusts the file path contents at read time rather than verifying integrity against a value captured at write time. No cryptographic verification or secure handoff (such as a protected directory, named pipe, or memory handle) is used between the unprivileged and privileged components.

Attack Vector

Exploitation requires local access with low privileges and user interaction. The attacker must have a foothold on the system under the same user account that is launching Fiddler. The user must initiate the certificate trust operation and approve the UAC elevation prompt for the TrustCert helper. During that narrow window, the attacker's process monitors the temporary file path and overwrites it with a prepared malicious root certificate before the helper reads it. The attack does not require network access and does not affect availability.

No public proof-of-concept exploit is available. See the Telerik Security KB: CVE-2026-77804 for vendor technical details.

Detection Methods for CVE-2026-77804

Indicators of Compromise

Unexpected root certificates present in the Local Computer Trusted Root Certification Authorities store that do not match the legitimate Fiddler root (DO_NOT_TRUST_FiddlerRoot).
File write events to Fiddler's temporary certificate staging path from processes other than Fiddler.exe.
Launches of TrustCert.exe shortly after suspicious file modification events in user-writable temporary directories.
TLS connections to legitimate services presenting certificates chained to an unexpected local root CA.

Detection Strategies

Monitor the Windows certificate store for additions to Cert:\LocalMachine\Root and alert on any new root CA not present in a baseline.
Correlate process creation events for TrustCert.exe with preceding file-write events on the certificate staging path by non-Fiddler processes.
Use endpoint telemetry to flag any process that writes to Fiddler's temp certificate file while Fiddler.exe is running.

Monitoring Recommendations

Enable Windows Security event auditing for certificate store modifications (Event IDs related to CAPI2 operational log).
Collect Sysmon file-create and process-create events on hosts where Fiddler Classic is installed.
Baseline trusted root certificates across the fleet and alert on deviations.

How to Mitigate CVE-2026-77804

Immediate Actions Required

Upgrade Progress Telerik Fiddler Classic to version v6.0.20262.10021 or later on all Windows endpoints.
Inventory the Local Computer Trusted Root Certification Authorities store on hosts that have run vulnerable Fiddler versions and remove any unauthorized root CAs.
Restrict installation of Fiddler Classic to users and systems with a documented need for HTTPS interception.

Patch Information

Progress has addressed the vulnerability in Telerik Fiddler Classic v6.0.20262.10021. The fix removes the TOCTOU window in the certificate installation workflow between Fiddler and the TrustCert helper. Refer to the Telerik Security KB: CVE-2026-77804 for vendor remediation guidance.

Workarounds

Avoid using the Fiddler HTTPS decryption feature on vulnerable versions until patched.
Decline the UAC elevation prompt for TrustCert unless the certificate trust operation is expected and the system is trusted.
Run Fiddler Classic only on dedicated analyst workstations where other local user processes cannot interfere with its temporary files.
Enforce application allowlisting to prevent untrusted processes from executing in the context of users who run Fiddler.

bash

# Enumerate trusted root certificates on a Windows host (PowerShell)
Get-ChildItem -Path Cert:\LocalMachine\Root |
  Select-Object Subject, Thumbprint, NotAfter |
  Sort-Object Subject