{"affected":[{"defaultStatus":"unaffected","product":"Fiddler Download & Setup Skill","source":"CNA: ProgressSoftware","vendor":"Progress Software","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-104657","cwes":["CWE-494","CWE-377"],"description":"Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.","epss":{"date":"2026-11-08","percentile":0.06339,"score":0.00169},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: ProgressSoftware","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: security@progress.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794220777797,"publishedAt":1793982801722,"references":[{"source":"CNA: ProgressSoftware","tags":["vendor-advisory"],"url":"https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-missing-download-integrity-verification-cve-2026-104657"},{"source":"security@progress.com","tags":[],"url":"https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-missing-download-integrity-verification-cve-2026-104657"}],"remediation":[{"kind":"workaround","source":"CNA: ProgressSoftware","text":"Do not run the affected skill version. Install Fiddler manually from the official distribution source, verify the downloaded artifact's publisher signature and available checksum, and on macOS use a per-user DMG installation without administrator privileges."}],"revision":"cc576e17f6e1e4c8a0bdc7d14936615b64568581b50c353e99b815af12384830","sources":[{"modifiedAt":1794220777797,"name":"CNA: ProgressSoftware","retrievedAt":1794222498332,"url":"https://www.cve.org/CVERecord?id=CVE-2026-104657"},{"modifiedAt":1793997533570,"name":"NVD","retrievedAt":1794011181403,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104657"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794222528924,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104657"}],"ssvc":{"assessedAt":1793985251732,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill","updatedAt":1794222528924}