Progress Telerik Fiddler Classic prior 6.0.20262.10021 HTTPS interception root certificate installation toctou

Summaryinfo

A vulnerability, which was classified as problematic, was found in Progress Telerik Fiddler Classic. This issue affects some unknown processing of the component HTTPS interception root certificate installation. The manipulation results in toctou. This vulnerability is cataloged as CVE-2026-77804. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Progress Telerik Fiddler Classic. Affected is some unknown functionality of the component HTTPS interception root certificate installation. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary file in a user-writable location and then launches the external TrustCert helper application, which elevates and imports the certificate from that file. A local threat actor with low privileges who replaces the temporary file between the time it is written and the time the elevated helper reads it can cause an attacker-supplied root certificate to be installed in the Local Computer Trusted Root Certification Authorities store, enabling subsequent interception and modification of TLS-protected traffic on the machine. Successful exploitation requires the user to initiate the certificate trust operation and approve the elevation prompt.

The advisory is shared for download at docs.telerik.com. This vulnerability is traded as CVE-2026-77804 since 08/21/2026. The exploitability is told to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 6.0.20262.10021 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Progress

Name

• Telerik Fiddler Classic

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion