Vulnerabilities
Fiddler Classic flaws let local users plant a root CA
Four Fiddler Classic flaws, two letting a standard user hijack its elevated helpers. Fixed build, workarounds and how to spot a rogue root certificate.
Progress has fixed four vulnerabilities in Telerik Fiddler Classic, the Windows web debugging proxy that developers and testers use to read and modify HTTP and HTTPS traffic. The two that matter most, CVE-2026-77805 (CVSS 7.9) and CVE-2026-77804 (CVSS 6.6), let a low-privileged local user abuse the helper programs Fiddler runs with admin rights. One runs a different signed program as Administrator. The other gets an attacker's root certificate trusted by the whole machine. Every Fiddler Classic build up to 6.0.20261.7291 is affected, and the fix is 6.0.20262.10021, released on October 5.
None of the four can be reached remotely by someone without an account, and Progress reports no exploitation. The exposure is on shared Windows machines: test VMs, build agents, jump boxes and lab PCs where several people log in and someone with admin rights uses Fiddler. On those hosts the attacker needs one thing from the victim, an approved User Account Control (UAC) elevation prompt they were expecting anyway. The NATO Cyber Security Centre found and reported all four.
How it works
Fiddler decrypts HTTPS by sitting in the middle of the connection. It creates its own root certificate, named DO_NOT_TRUST_FiddlerRoot, and uses it to sign a certificate for each site on the fly. Applications accept those only if the root is trusted, so Fiddler offers to install it, first for the current user and then, optionally, for the whole machine. Writing to the machine store needs admin rights, so Fiddler hands that job, and a few others such as the Windows 8 loopback exemptions tool, to small helper programs that ask for elevation.
CVE-2026-77804: a race in certificate trust
To trust its root machine-wide, Fiddler writes the certificate to a temporary file in a folder ordinary users can write to, then starts the TrustCert helper, which elevates and imports whatever that file contains. The gap between the write and the elevated read is a time-of-check time-of-use race, CWE-367 in the weakness catalogue. A standard user who replaces the file inside that gap gets their own certificate into the Local Computer Trusted Root Certification Authorities store.
From then on, every application on the machine that relies on the Windows store accepts any TLS certificate the attacker issues. That covers every account on the box, so the attacker can intercept or alter encrypted traffic for other users too. The victim has to start the trust operation and approve the UAC prompt. The score is 6.6, with the vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.
CVE-2026-77805: a signature check that accepts the wrong file
Before launching a helper, Fiddler checks that the file carries a valid Authenticode signature from a publisher on its allow list. It does not check that the file is the specific executable shipped with that Fiddler version (CWE-347). An attacker who can write where the helper lives can swap in any other binary signed by an allow-listed publisher, and Fiddler will run it.
If the helper is one that elevates, the substitute runs as Administrator once the user approves the prompt. That jump across accounts is why the score is 7.9 with a changed scope. Fiddler had a narrower version of this bug before: CVE-2019-12097, in build 5.0.20182.28034, where Fiddler did not verify the hash of EnableLoopback.exe before running it.
The two proxy bugs
CVE-2026-77802 (CVSS 6.3) and CVE-2026-77803 (CVSS 3.6) are request smuggling flaws in the proxy's forwarding code. In the first, a request with conflicting Content-Length headers is forwarded unchanged while Fiddler reads the body using only the first value. Against an origin server that does not follow RFC 9110, the extra response stays buffered on a reused server connection and is served to the next session, which may belong to another user.
In the second, a request carrying both Content-Length and Transfer-Encoding is forwarded with both intact while Fiddler frames it by Transfer-Encoding. Leftover bytes on a reused client connection are then parsed as a second request, and no vulnerable server is needed. Both only matter where more than one user sends traffic through the same Fiddler instance.
What attackers are doing
Nothing has been reported. Progress's advisories mention no exploitation, none of the four is in CISA's Known Exploited Vulnerabilities catalog, and each needs local access or the ability to send traffic through someone else's Fiddler. The realistic attacker already has a standard account on a shared Windows host and wants Administrator or a view of everyone's TLS traffic.
What to do
1. Update
Install Fiddler Classic 6.0.20262.10021 or later on every machine that has it, starting with shared ones. Check the installed version in Settings > Apps. The advisories cover Fiddler Classic for Windows only; Fiddler Everywhere is a separate product and is not named in them.
2. If you cannot update today
- Trust the Fiddler root only in the Current User store, from inside Fiddler. When it asks whether to also trust the certificate in the Local Computer store, answer No.
- If a tool genuinely needs machine-wide trust, export the root from Tools > Options > HTTPS to a file and import it yourself with
certlm.msc. That removes the temporary file and the race. - Do not launch Fiddler's external tools, such as the Windows 8 loopback exemptions tool or the machine store trust tool. Read every UAC prompt Fiddler raises and check the program name, verified publisher and file location are what you expect.
- For the smuggling bugs, untick Reuse server connections (CVE-2026-77802) and Reuse client connections (CVE-2026-77803) under Tools > Options > Connections.
3. Check for a rogue root certificate
Open certlm.msc and go to Trusted Root Certification Authorities > Certificates, or list the store in PowerShell:
Get-ChildItem Cert:\LocalMachine\Root | Sort-Object NotBefore -Descending | Format-Table Subject, Thumbprint, NotBefore
The swapped file does not have to carry Fiddler's name, so review every root in the list. Anything you cannot tie to Microsoft, your own PKI or a tool you installed needs explaining. If there is a DO_NOT_TRUST_FiddlerRoot entry in the machine store, compare its thumbprint with the one in Cert:\CurrentUser\Root for the user who runs Fiddler: they should match. The NotBefore date is set by whoever made the certificate, so it says nothing reliable about when it was added. Comparing the list with a clean machine built from the same image is the quickest way to spot extras.
For CVE-2026-77805, reinstalling 6.0.20262.10021 replaces the helper executables. Before you do, record the hashes of the .exe files in the Fiddler install folder with Get-FileHash and compare them with a fresh install on a clean machine, so you know whether anything was swapped.
4. Clean up if you find something
Delete the rogue root from the Local Computer store and from every user's Current User store. Treat TLS traffic from that machine since the certificate appeared as readable: rotate passwords, API keys and session tokens used there. If a substituted helper ran as Administrator, the attacker had full control, so rebuild the machine rather than clean it.
The wider lesson
Debugging proxies and loopback tools ask for elevation now and then, and on a shared host each of those prompts is a privilege boundary that a standard user can try to sit inside. Keep interception roots in the Current User store, install such tools where standard users cannot write, and remove Fiddler's root when a test engagement ends.
Our safeguarding and hardening work reviews shared developer and test machines for exactly this kind of local escalation path, and our security operations team can watch for new roots appearing in machine certificate stores. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: Telerik KB, CVE-2026-77805, Telerik KB, CVE-2026-77804, Telerik KB, CVE-2026-77802, Telerik KB, CVE-2026-77803, eSecurity Planet, INCIBE-CERT, CVE-2026-77804, INCIBE-CERT, CVE-2026-77805, INCIBE-CERT, CVE-2019-12097, Telerik forums, Fiddler root certificate name.