Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Description

Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.

Scores

EPSS (exploitation in 30 days)

0.09% · top 100% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.

Weakness

• CWE-306: Missing Authentication for Critical Function (opens in a new tab)All about CWE-306 and its CVEs

Affected products

• Progress Software · Progress® Telerik® Fiddler® Everywhere

  • affected 1.0.0 – < 8.2.0

References (1)

• https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-missing-authentication-for-critical-function-cve-2026-86158 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-86158](https://trackcve.app/badge/CVE-2026-86158.svg)](https://trackcve.app/cve/CVE-2026-86158)

Record last updated 30 Sept 2026, 15:28 UTC.