CVE-2026-25791: Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap…

PriorityP347high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.41%

33.0th percentile

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
bishopfox	sliver	< 1.7.0	1.7.0
github.com	bishopfox_sliver	>= 0 < 1.6.12	1.6.12

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.