{"metadata": {"vulnerability": "CVE-2025-27090", "count": 28, "kinds": {"milestone": 5, "sighting": 10, "kev": 0, "other": 13}}, "data": [{"timestamp": "2025-02-18T16:44:48.764Z", "date_only": false, "value": "2025-02-18T16:44:48.764Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-27090", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-02-19T20:35:01Z", "date_only": false, "value": "2025-02-19T20:35:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/BishopFox/sliver/security/advisories/GHSA-fh4v-v779-4g2w", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "f7381675-3ae5-4b41-b1d6-61cb66a8ca6d", "url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-fh4v-v779-4g2w"}, {"timestamp": "2025-02-19T21:11:06.671Z", "date_only": false, "value": "2025-02-19T21:11:06.671Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-27090", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-02-19T21:11:06.671Z", "date_only": false, "value": "2025-02-19T21:11:06.671Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2025-27090", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-19T21:11:33Z", "date_only": false, "value": "2025-02-19T21:11:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FH4V-V779-4G2W", "record": "GHSA-FH4V-V779-4G2W", "field": "published"}, {"timestamp": "2025-02-19T21:37:18.171Z", "date_only": false, "value": "2025-02-19T21:37:18.171767Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-27090", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-02-19T21:37:18.171Z", "date_only": false, "value": "2025-02-19T21:37:18.171767Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-27090", "record": "FKIE_CVE-2025-27090", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-02-19T21:37:35.320Z", "date_only": false, "value": "2025-02-19T21:37:35.320Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-27090", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-02-19T21:37:35.320Z", "date_only": false, "value": "2025-02-19T21:37:35.320Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-27090", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-19T22:15:24Z", "date_only": false, "value": "2025-02-19T22:15:24Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FH4V-V779-4G2W", "record": "GHSA-FH4V-V779-4G2W", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-02-19T22:15:24.247Z", "date_only": false, "value": "2025-02-19T22:15:24.247", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-27090", "record": "FKIE_CVE-2025-27090", "field": "published"}, {"timestamp": "2025-02-19T23:46:02Z", "date_only": false, "value": "2025-02-19T23:46:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/18479", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "7a96ea10-2f8f-41be-ae90-f080a0c50a2f", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27090 - Sliver Teamserver Unauthenticated Reverse Port Forwarding Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-27090 \nPublished : Feb. 19, 2025, 10:15 p.m. | 27\u00a0minutes ago \nDescription : Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so. The only impact that has been shown is the exposure of the server's IP address to a third party. This issue has been addressed in version 1.5.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/18479"}, {"timestamp": "2025-02-20T11:09:34.929Z", "date_only": false, "value": "2025-02-20T11:09:34.929358Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3lim5oe2oss2u", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "ceb706a8-0417-4777-8715-23351bc7afa9", "url": "https://bsky.app/profile/undercode.bsky.social/post/3lim5oe2oss2u"}, {"timestamp": "2025-02-20T12:40:54.954Z", "date_only": false, "value": "2025-02-20T12:40:54.954051Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/andranglin.bsky.social/post/3limcrpgqfs27", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "9ea10199-1fa9-4b24-85fe-9e88566843ef", "url": "https://bsky.app/profile/andranglin.bsky.social/post/3limcrpgqfs27"}, {"timestamp": "2025-02-20T22:47:01Z", "date_only": false, "value": "2025-02-20T22:47:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FH4V-V779-4G2W", "record": "GHSA-FH4V-V779-4G2W", "field": "modified"}, {"timestamp": "2025-02-22T18:09:41.542Z", "date_only": false, "value": "2025-02-22T18:09:41.542656Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3lirw3gqeok2i", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "2b3131dd-6b32-4d5c-8821-d8a9c7b45a56", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3lirw3gqeok2i"}, {"timestamp": "2025-03-13T00:00:00Z", "date_only": false, "value": "2025-03-13T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14889-1", "record": "OPENSUSE-SU-2025:14889-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-03-13T00:00:00Z", "date_only": false, "value": "2025-03-13T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14889-1", "record": "OPENSUSE-SU-2025:14889-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2025-03-13T00:00:00Z", "date_only": false, "value": "2025-03-13T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14889-1", "record": "OPENSUSE-SU-2025:14889-1", "field": "document.tracking.generator.date"}, {"timestamp": "2025-03-13T00:00:00Z", "date_only": false, "value": "2025-03-13T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14889-1", "record": "OPENSUSE-SU-2025:14889-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-04-01T14:48:40Z", "date_only": false, "value": "2025-04-01T14:48:40.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/suboxone_chatroom/7446", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "f2eba248-3aca-4946-8a24-99d05d6db3a0", "content": "\ud83d\udc7b\ud83d\udc7b\ud83d\udc7bSSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers. \n\n\ud83d\udd25\ud83d\udd25\ud83d\udd25Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors.\n\nWriteup- https://blog.chebuya.com/posts/server-side-request-forgery-on-sliver-c2/\n\nPOC- https://github.com/chebuya/exploits/tree/main/CVE-2025-27090%3A%20Sliver%20C2%20SSRF", "url": "https://t.me/suboxone_chatroom/7446"}, {"timestamp": "2026-06-17T09:03:00.813Z", "date_only": false, "value": "2026-06-17T09:03:00.813", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-27090", "record": "FKIE_CVE-2025-27090", "field": "lastModified"}, {"timestamp": "2026-07-09T03:00:09.554Z", "date_only": false, "value": "2026-07-09T03:00:09.554328Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/brutsecurity/1548", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "9d802ea5-8339-4328-b9f2-fb61f06199ec", "content": "\ud83d\udc7b\ud83d\udc7b\ud83d\udc7bSSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers. \n\n\ud83d\udd25\ud83d\udd25\ud83d\udd25Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors.\n\nWriteup- https://blog.chebuya.com/posts/server-side-request-forgery-on-sliver-c2/\n\nPOC- https://github.com/chebuya/exploits/tree/main/CVE-2025-27090%3A%20Sliver%20C2%20SSRF", "url": "https://t.me/brutsecurity/1548"}, {"timestamp": "2026-07-11T14:00:03.854Z", "date_only": false, "value": "2026-07-11T14:00:03.854689Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/brutsecurity/1548", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "02e089f1-3f5d-4526-a80c-60846e0e3b28", "content": "\ud83d\udc7b\ud83d\udc7b\ud83d\udc7bSSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers. \n\n\ud83d\udd25\ud83d\udd25\ud83d\udd25Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors.\n\nWriteup- https://blog.chebuya.com/posts/server-side-request-forgery-on-sliver-c2/\n\nPOC- https://github.com/chebuya/exploits/tree/main/CVE-2025-27090%3A%20Sliver%20C2%20SSRF", "url": "https://t.me/brutsecurity/1548"}, {"timestamp": "2026-07-12T22:00:09.314Z", "date_only": false, "value": "2026-07-12T22:00:09.314274Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/1104", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "f514341d-bec1-41cf-859e-9470ac1c7471", "content": "SSRF \u0432 C2 Sliver Teamserver CVE-2025-27090\n\nAffected versions: >= 1.5.26, <= 1.5.42\nPatched versions: 1.5.43\n\nInfo: https://github.com/advisories/GHSA-fh4v-v779-4g2w\n\nPoC: [https://github.com/chebuya/exploits/tree/main/CVE-2025-27090%3A%20Sliver%20C2%20SSRF]", "url": "https://t.me/securixy_kz/1104"}, {"timestamp": "2026-07-14T00:01:01.597Z", "date_only": false, "value": "2026-07-14T00:01:01.597457Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/securixy_kz/1104", "record": "CVE-2025-27090", "field": "creation_timestamp", "uuid": "d91917e3-cd41-4f40-b224-afd9c21d6b31", "content": "SSRF \u0432 C2 Sliver Teamserver CVE-2025-27090\n\nAffected versions: >= 1.5.26, <= 1.5.42\nPatched versions: 1.5.43\n\nInfo: https://github.com/advisories/GHSA-fh4v-v779-4g2w\n\nPoC: [https://github.com/chebuya/exploits/tree/main/CVE-2025-27090%3A%20Sliver%20C2%20SSRF]", "url": "https://t.me/securixy_kz/1104"}, {"timestamp": "2026-09-20T21:29:12Z", "date_only": false, "value": "2026-09-20T21:29:12Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14889-1", "record": "OPENSUSE-SU-2025:14889-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T21:29:12Z", "date_only": false, "value": "2026-09-20T21:29:12Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14889-1", "record": "OPENSUSE-SU-2025:14889-1", "field": "document.tracking.current_release_date"}]}