CVE-2026-104656

Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0…

Risk score: 44/100
CVSS: 7.3 v3.1
Published: 6 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 7.3 high

References

https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-cross-site-scripting-cve-2026-104656

Original description

Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.

Last activity 6 Nov 2026. Patch Forecast updates every hour.