Vulnerability · Published Sep 29, 2026 · Assigned by ProgressSoftware
CVE-2026-86158Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere
High 7.7
In plain English
A high-severity missing authentication in Progress® Telerik® Fiddler® Everywhere from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)<0.1%top 99.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Progress® Telerik® Fiddler® Everywhere | 1.0.0 – before 8.2.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N