{"id":"CVE-2026-104657","aliases":["EUVD-2026-118358","GHSA-cwv8-gh9g-g9wh"],"status":"published","title":"Missing Integrity Verification in Progress Software Fiddler Download \u0026 Setup Skill","description":"Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00169,"percentile":0.06364,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-377","CWE-494"],"published":"2026-11-06T16:33:21Z","modified":"2026-11-06T18:35:22Z","products":[{"vendor":"progress software","product":"fiddler download \u0026 setup skill"}],"references":[{"url":"https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-missing-download-integrity-verification-cve-2026-104657","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104657"},{"url":"https://github.com/advisories/GHSA-cwv8-gh9g-g9wh"}],"sources":{"cve":[{"id":"CVE-2026-104657","title":"Missing Integrity Verification in Progress Software Fiddler Download \u0026 Setup Skill","description":"Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.","status":"published","published":"2026-11-06T16:33:21.722Z","modified":"2026-11-09T10:39:37.797Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-494","CWE-377"],"updated_at":"2026-11-09T11:32:58.17855Z"}],"euvd":[{"id":"EUVD-2026-118358","description":"Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.","status":"published","published":"2026-11-06T16:33:21Z","modified":"2026-11-09T10:39:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T21:07:02.228784Z"}],"ghsa":[{"id":"GHSA-cwv8-gh9g-g9wh","title":"Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux...","description":"Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.","status":"published","published":"2026-11-06T18:35:15Z","modified":"2026-11-06T18:35:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-377"],"updated_at":"2026-11-06T19:01:27.658277Z"}],"nvd":[{"id":"CVE-2026-104657","description":"Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.","status":"published","published":"2026-11-06T17:17:11.353Z","modified":"2026-11-06T20:38:53.57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-377","CWE-494"],"updated_at":"2026-11-06T22:02:17.053381Z"}]}}