CVE-2026-77805: Telerik Fiddler Classic Privilege Escalation

CVE-2026-77805 Overview

CVE-2026-77805 affects Progress Telerik Fiddler Classic for Windows in versions prior to v6.0.20262.10021. The application performs insufficient integrity checks on external helper tools before launching them. Instead of validating the specific executable shipped with the product, Fiddler Classic only confirms that the file carries a valid Authenticode signature and that the certificate subject matches a broad allow list of publisher name fragments. A local attacker with low privileges can replace a helper executable with any other validly signed binary from an allow-listed publisher. The substituted binary then executes under Fiddler Classic, including with Administrator rights for helpers that request elevation.

Critical Impact
Local privilege escalation to Administrator through substitution of allow-listed, validly signed helper binaries that Fiddler Classic launches without strict identity verification.

Affected Products

Progress Telerik Fiddler Classic for Windows prior to v6.0.20262.10021
Fiddler Classic external helper tool launch workflow
Windows installations where Fiddler Classic helpers execute with elevation

Discovery Timeline

2026-10-05 - CVE-2026-77805 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-77805

Vulnerability Analysis

The weakness is an improper signature verification issue classified as [CWE-347]. Fiddler Classic invokes external helper tools to perform auxiliary operations, some of which trigger a User Account Control (UAC) elevation prompt. Before launching a helper, the application calls Authenticode verification and inspects the signing certificate subject. It accepts any binary whose signer name contains one of several allow-listed publisher fragments. The check does not pin the hash, original filename, product name, or version of the shipped helper.

An attacker who can write to the directory containing the helper executables can replace a helper with a different, unrelated binary that happens to be signed by an allow-listed publisher. When the user later launches the affected tool from Fiddler Classic and approves the elevation prompt, Windows runs the attacker-chosen binary with Administrator privileges in the context of the Fiddler Classic process chain. Successful exploitation requires user interaction and the user approving an elevation prompt that may reference a different executable name than expected.

Root Cause

The root cause is reliance on broad publisher name matching as the sole integrity signal for executables launched by the application. Authenticode signature validity and signer identity do not uniquely identify a specific executable. Any other binary legitimately signed by the same publisher satisfies the check.

Attack Vector

Exploitation requires local access with low privileges, user interaction, and the user approving a UAC elevation prompt. The attacker stages a validly signed binary from an allow-listed publisher in place of a Fiddler Classic helper. When the user triggers the helper from the Fiddler Classic interface, the substituted binary runs, inheriting the requested elevation.

No synthetic exploit code is published here. Technical specifics are available in the Telerik Security Advisory CVE-2026-77805.

Detection Methods for CVE-2026-77805

Indicators of Compromise

Modification timestamps on files in the Fiddler Classic helper tools directory that do not match the installed product version
Helper executables whose file hash, original filename, or product metadata differ from the shipped Fiddler Classic distribution
UAC elevation events where the elevated image path points inside the Fiddler Classic install directory but the signer or product name is unexpected
Child processes of Fiddler.exe that are unrelated to known helper utilities

Detection Strategies

Baseline the Fiddler Classic installation directory and alert on write operations to helper executables by non-installer processes
Correlate Windows Security event ID 4688 process creation with image hash lookups to detect substituted helpers under the Fiddler Classic path
Hunt for Authenticode-signed binaries from allow-listed publishers executing from the Fiddler Classic directory that are not the expected helper filenames

Monitoring Recommendations

Enable Sysmon FileCreate and ProcessCreate logging for the Fiddler Classic install path and ship events to a central analytics platform
Monitor consent.exe elevation prompts that originate from Fiddler Classic for unexpected target image paths
Track installations of Fiddler Classic across the fleet and flag versions prior to v6.0.20262.10021

How to Mitigate CVE-2026-77805

Immediate Actions Required

Upgrade Progress Telerik Fiddler Classic to version v6.0.20262.10021 or later on all Windows endpoints
Audit the Fiddler Classic install directory for unauthorized modifications to helper executables
Restrict write access to the Fiddler Classic installation directory to administrators only
Instruct users to cancel any UAC elevation prompt whose target executable name does not match the expected helper

Patch Information

Progress has addressed the weak integrity check in Telerik Fiddler Classic v6.0.20262.10021. Review the Telerik Security Advisory CVE-2026-77805 for the fixed version details and upgrade guidance.

Workarounds

Remove or disable optional external helper tools inside Fiddler Classic that are not required for daily workflows
Apply Windows file system access control lists (ACLs) that prevent standard users from writing to the Fiddler Classic install directory
Deploy application control policies, such as Windows Defender Application Control or AppLocker, that pin helper executables to known-good file hashes

bash

# Example: tighten ACLs on the Fiddler Classic install directory (run as Administrator)
icacls "C:\Program Files (x86)\Fiddler" /inheritance:r
icacls "C:\Program Files (x86)\Fiddler" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"