CVE-2026-104656

CVSS 7.3 (high) · published 2026-11-06

Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.

Weakness: CWE-79

Source: NVD CVE-2026-104656

References

• https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-cross-site-scripting-cve-2026-104656

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.