CVE-2026-34227 Bishopfox CVE debrief

Who should care

Organizations using Sliver version prior to 1.7.4 should be aware of this vulnerability and take immediate action to patch their systems. This includes reviewing their current Sliver version, updating to version 1.7.4 or later, and ensuring that all active C2 sessions or beacons are properly secured. Operators, platform administrators, vulnerability management teams, and security teams should review the current Sliver version and implement necessary updates.

Technical summary

The Sliver command and control framework, prior to version 1.7.4, is vulnerable to an attack that allows an unauthenticated attacker to gain control over active C2 sessions or beacons. This is achieved through a custom Wireguard netstack and can be exploited through a single click on a malicious link. The vulnerability has been patched in version 1.7.4. The technical impact includes potential exfiltration of collected target data or destruction of the compromised infrastructure. Defenders should focus on updating to version 1.7.4 or later and securing all active C2 sessions or beacons.

Defensive priority

High

Recommended defensive actions

• Update Sliver to version 1.7.4 or later
• Review and secure all active C2 sessions or beacons
• Monitor for suspicious activity related to Sliver
• Implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-03-31T16:16:32.440Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The Sliver command and control framework, prior to version 1.7.4, is vulnerable to an attack that allows an unauthenticated attacker to gain control over active C2 sessions or beacons. This is achieved through a custom Wireguard netstack and can be exploited through a single click on a malicious link. The vulnerability has been patched in version 1.7.4. Evidence limits suggest that defenders verify Sliver version and update to 1.7.4 or later.

Official resources