TI-2026-58946 Aliases CVE-2026-86157 GHSA-299j-hfrq-4753

Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere

LOW 24CWE-749Published 2026-09-29 · Updated 2026-09-30

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled content. Successful exploitation could result in disclosure of OAuth authentication tokens, execution of locally accessible programs, or unauthorized modification of application-generated configuration files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00119 1st percentileScored 2026-11-07

Fix Fixed Progress® Telerik® Fiddler® Everywhere (Progress Software): 8.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Progress	Progress® Telerik® Fiddler® Everywhere	1.0.0 to before 8.2.0	8.2.0	Patch available	CNA

Progress® Telerik® Fiddler® Everywhere VendorProgress Affected 1.0.0 to before 8.2.0 Fixed in 8.2.0 Patch available CNA

Remediation

Fix · CNA Progress® Telerik® Fiddler® Everywhere (Progress Software) Fixed in 8.2.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-29
Progress® Telerik® Fiddler® Everywhere 8.2.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-58947 Missing Authentication in the local .NET backend of Progress Telerik Fiddler EverywherePriority LOW 34
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-86157
2026-10-03 Alias added: GHSA-299j-hfrq-4753

References

Advisory 1

https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-exposed-dangerous-method-or-function-cve-2026-86157

TI-2026-07083 Command injection in Progress LoadMaster KEVCVSS 3.1CRITICAL 9.8
TI-2024-06182 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-04541 WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-04060 Registration Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-01127 LoadMaster Pre-Authenticated OS Command Injection KEVCVSS 3.1CRITICAL 10.0
TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0

See all 436 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences