CVE-2026-1858 — wget2 accepts a server certificate with incorrect Key Usage

title: Wget2 Server Certificate Key Usage Mismatch - CVE-2026-1858
id: scw-2026-04-29-ai-1
status: experimental
level: medium
description: |
  Detects the execution of wget2 with command-line arguments indicating the use of specific certificate and private key files. This rule is specific to CVE-2026-1858, where wget2 might accept a server certificate with an incorrect Key Usage (KU) or Extended Key Usage (EKU). Attackers could exploit this by reusing a compromised certificate for TLS server authentication, potentially leading to man-in-the-middle attacks or unauthorized access. This rule aims to flag suspicious wget2 executions that might be leveraging a vulnerable certificate.
author: SCW Feed Engine (AI-generated)
date: 2026-04-29
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-1858/
tags:
  - attack.defense_evasion
  - attack.t1553.004
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files\wget2\wget2.exe'
      ParentImage|contains:
          - 'cmd.exe'
          - 'powershell.exe'
      CommandLine|contains:
          - '--certificate-file'
          - '--private-key-file'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse