CVE-2026-34227

HighPublic PoC

Published: 31 March 2026

Published

31 March 2026

Modified

03 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0002 6.2th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34227 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Bishopfox Sliver. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 6.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SC-23 (Session Authenticity).

Threat & Defense at a Glance

What attackers do: exploitation maps to Spearphishing Link (T1566.002) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Directly mitigates CWE-306 (Missing Authentication for Critical Function) by prohibiting unauthenticated actions on C2 sessions, preventing hijacking via malicious links.

SC-23 Session Authenticity good match

preventdetect

Protects the authenticity of C2 communications sessions and detects/terminates hijacking attempts, addressing session takeover in the operator's browser.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and remediation of flaws like this high-severity vulnerability, ensuring upgrade to patched version 1.7.4.

MITRE ATT&CK Enterprise TechniquesAI

T1566.002 Spearphishing Link Initial Access

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

Why these techniques?

The vulnerability explicitly enables hijacking of C2 operator sessions via the browser by tricking the operator into clicking a malicious link (missing auth for critical functions), directly mapping to T1185 Browser Session Hijacking facilitated via T1566.002 Spearphishing Link.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of…

exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser. This issue has been patched in version 1.7.4.

Deeper analysisAI

CVE-2026-34227 is a high-severity vulnerability (CVSS 3.1 score of 8.8) affecting Sliver, an open-source command and control (C2) framework that implements a custom Wireguard netstack. Versions prior to 1.7.4 are vulnerable due to weaknesses mapped to CWE-306 (Missing Authentication for Critical Function) and CWE-942 (Permissible Navigational Transitions). The flaw enables attackers to hijack C2 operator sessions through the operator's browser without authentication.

An unauthenticated attacker can exploit this vulnerability remotely over the network with low complexity by tricking a Sliver C2 operator into clicking a malicious link (user interaction required). Successful exploitation grants the attacker silent, immediate control over all active C2 sessions and beacons implanted on target systems. This allows full exfiltration of sensitive collected data, such as SSH keys or ntds.dit files, or complete destruction of the compromised infrastructure, all executed client-side in the operator's browser.

The issue was patched in Sliver version 1.7.4, as detailed in the BishopFox security advisory (GHSA-6fpf-248c-m7wm). Operators should upgrade immediately to mitigate risks, particularly given the framework's use in red teaming and adversary emulation where operator browsers may be exposed.