Fiddler Everywhere CVE-2026-86158

Requires local access to a host where Fiddler Everywhere 8.0.2 is installed and actively running, because the vulnerable Fiddler.WebUi .NET backend exposes an HTTP and SignalR RPC channel bound to localhost with no authentication. Any local user or process able to reach the loopback interface - including other users on a shared workstation or malicious local software - can invoke the RPC methods to mint OAuth tokens and read the MITM root certificate. Limiting factors: exploitation is confined to the local machine (no remote/network vector), and the Fiddler application must be running for the RPC endpoint to be listening; no user interaction or prior authentication is needed once those conditions hold.

This is a moderate-priority, locally-scoped issue rather than a widespread remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, vendor score 7.7) is unambiguous that exploitation requires LOCAL access to the host running Fiddler Everywhere - the vulnerable Fiddler.WebUi backend binds an unauthenticated HTTP and SignalR RPC channel to localhost only, so there is no network attack surface. The high severity comes from the impact side: C:H and I:H reflect that an attacker can read the machine-in-the-middle root certificate (confidentiality - enables TLS interception/impersonation) and mint OAuth tokens (integrity - forge authenticated actions). No EPSS score, no CISA KEV listing, and no POC are present in the provided data, and the vulnerability was self-reported by the vendor (Progress Software) rather than discovered in-the-wild. The local-only vector plus absence of any exploitation signal places this well below internet-facing critical bugs despite the 7.7 rating. Note the vendor 7.7 score is slightly higher than the standard CVSS 3.1 calculation for this exact vector (~7.1); this discrepancy is minor and does not change the priority tier.

A low-privileged or unauthenticated local process (or a second user on a shared/multi-user workstation) connects to the localhost HTTP/SignalR RPC endpoint exposed by a running Fiddler Everywhere 8.0.2 instance, which performs no authentication on callers. The attacker invokes RPC methods to mint OAuth tokens and to retrieve the Fiddler MITM root certificate, enabling session forgery and TLS interception. No public exploit is identified at time of analysis and no user interaction is required once the app is running.