Vulnerability · Published Sep 29, 2026 · Assigned by ProgressSoftware

CVE-2026-86157Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere

Medium 5.6

In plain English

A medium-severity security flaw in Progress® Telerik® Fiddler® Everywhere from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)0.1%top 98.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled content. Successful exploitation could result in disclosure of OAuth authentication tokens, execution of locally accessible programs, or unauthorized modification of application-generated configuration files.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	Progress® Telerik® Fiddler® Everywhere	1.0.0 – before 8.2.0

Weakness: CWE-749 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

References

https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-exposed-dangerous-method-or-function-cve-2026-86157 vendor-advisory