Description
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.
Published: 2026-11-06
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution via compromised download component
Action: Apply Workaround
AI Analysis

Impact

This vulnerability arises from missing integrity checks in the Progress Software Fiddler Download & Setup Skill. The flaw permits an attacker to influence the download or replacement of the release package. When a user runs the skill, the skill may execute attacker‑controlled code because the integrity of the component is not verified, mapping to CWE‑377 and CWE‑494.

Affected Systems

The affected software is the Fiddler Download & Setup Skill from Progress Software. Versions running on Linux, macOS, and Windows are impacted. No specific version ranges are listed, so any installation of the skill remains vulnerable until a fix is applied.

Risk and Exploitability

The CVSS score of 7.5 rates it as high severity, though the EPSS score is unavailable and it is not in the CISA KEV catalog. Typical exploitation would involve an attacker supplying a malicious package or replacing the staged package on macOS while the skill awaits user approval. The skill installs the package with administrator privileges on macOS, which means root‑level code execution is possible after user consent. In other platforms the attack remains a local privilege escalation that requires user interaction to run the skill.

Generated by OpenCVE AI on November 6, 2026 at 17:21 UTC.

Remediation

Vendor Workaround

Do not run the affected skill version. Install Fiddler manually from the official distribution source, verify the downloaded artifact's publisher signature and available checksum, and on macOS use a per-user DMG installation without administrator privileges.

OpenCVE Recommended Actions

  • Disable the Fiddler Download & Setup Skill or prevent its execution
  • Manually download and install Fiddler from the official distribution, ensuring publisher signature and checksum verification
  • On macOS, install the Fiddler package using a per‑user DMG without administrator privileges

Generated by OpenCVE AI on November 6, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 16:45:00 +0000

Type Values Removed Values Added
Description Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.
Title Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill
Weaknesses CWE-377
CWE-494
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-11-06T17:47:49.791Z

Reserved: 2026-10-02T07:20:03.845Z

Link: CVE-2026-104657

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T17:17:11.353

Modified: 2026-11-06T17:17:11.353

Link: CVE-2026-104657

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T17:30:09Z

Weaknesses
  • CWE-377

    Insecure Temporary File

  • CWE-494

    Download of Code Without Integrity Check