Missing Integrity Verification in Progress Software Fiddler on Multiple Platforms
CVE-2026-104657

7.5HIGH

Key Information:

Vendor

Progress Software
Status
Fiddler Download & Setup Skill
Vendor
CVE Published:
6 November 2026

What is CVE-2026-104657?

A missing integrity verification flaw in Progress Software's Fiddler Download and Setup Skill for Linux, macOS, and Windows enables attackers to manipulate release components, potentially executing malicious code when the skill is activated. On macOS, the skill installs packages with administrator privileges at a fixed location, creating an opportunity for local processes to replace the installation package while waiting for user approval, which could lead to unauthorized code execution with elevated privileges.

Affected Version(s)

Fiddler Download & Setup Skill 0 < 8.3.0

References

https://www.telerik.com/fiddler/fiddler-everywhere/docume...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz) & komyeonghane320f9
.