CVE-2026-34227

HighCVSS 8.8

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

Sliver before version 1.7.4 has a vulnerability where a single click on a malicious link gives an unauthenticated attacker immediate control over all active C2 sessions and beacons via the operator's browser, enabling data exfiltration or infrastructure destruction.

Risk Assessment

A single click by an operator on a malicious link can lead to full compromise of the C2 infrastructure, exfiltration of all collected data, and system destruction, without any authentication.

Recommendation

Upgrade Sliver to version 1.7.4 or later immediately, which fixes this vulnerability.

Other vulnerabilities in Sliver

CVE-2023-34758High
Sliver from versions 1.5.x to 1.5.39 has an improper cryptographic implementation, allowing attackers to execute a man-in-the-middle attack via intercepted and crafted responses.

Original NVD description (English source)

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser. This issue has been patched in version 1.7.4.