Sliver EUVD-2026-17490

This vulnerability presents severe real-world risk despite a moderate CVSS score of 5.9. The CVSS vector confirms unauthenticated remote access (AV:N, PR:N) with low attack complexity (AC:L), but the score is tempered by user interaction requirement (UI:A) and attack time contingency (AT:P). However, the impact is critical: high confidentiality loss (VC:H) enables exfiltration of all collected target data including SSH keys and NTDS.dit, while integrity and availability impacts (VI:L, VA:L) represent data manipulation and infrastructure destruction risks. The authentication bypass tag directly contradicts the CVSS lower score-this is a case where CVSS underrepresents real-world severity because the vulnerability enables complete takeover of an entire infrastructure's C2 backbone. Patch availability (version 1.7.4) and the lack of confirmed active exploitation in the wild (KEV status not provided) suggest this is a responsibly disclosed issue with time for defense. However, the simplicity of the attack (single click) and breadth of impact (all active sessions) make this a priority remediation for any organization using Sliver, regardless of CVSS numerical rating.

An attacker crafts a malicious link embedding a Sliver API payload and sends it via email or social engineering to a red team operator known to use Sliver. When the operator clicks the link while their Sliver web interface or API client is active and authenticated, the attack silently hijacks all active C2 sessions under that operator's control. The attacker then uses the compromised sessions to exfiltrate sensitive data collected from target systems (e.g., SSH keys, Windows NTDS.dit database) or deletes beacons and wipes logs to cover tracks. No public exploit code or CISA KEV confirmation has been identified at the time of this analysis, but the simplicity of the attack (single click, no authentication required from attacker) and the catastrophic impact (complete C2 infrastructure compromise) mean threat actors are likely to exploit this immediately upon discovering the pre-patch vulnerability in deployed Sliver instances.