CVE-2026-104656

HighCVSS 7.3

Published: 06/11/2026(UTC)Updated: 06/11/2026(UTC)Translated: 06/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.

Risk Assessment

Opening a malicious SAZ file may lead to unauthorized command execution in the application backend, potentially compromising user data confidentiality and integrity. The risk requires user interaction with the crafted file.

Recommendation

Update Fiddler Everywhere to a version later than 8.3.0 and exercise caution when opening SAZ files from untrusted sources.

Other vulnerabilities in Progress Telerik Fiddler Everywhere

CVE-2026-86157Medium
Progress Telerik Fiddler Everywhere before version 8.2.0 exposes privileged IPC functionality. A local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application can replace the application UI or settings with attacker-controlled content.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS