CVE-2026-86158

Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.

  • Published Sep 29, 2026
  • CVSS 7.7 high
  • 0.1% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-86158 at the National Vulnerability Database