CVE-2026-7397 — NousResearch Hermes-Agent Vulnerability

title: CVE-2026-7397 - NousResearch Hermes-Agent Symlink Following
id: scw-2026-04-29-ai-1
status: experimental
level: medium
description: |
  Detects the exploitation of CVE-2026-7397 in NousResearch Hermes-Agent. The vulnerability allows for symlink following in the _check_sensitive_path function, potentially leading to unauthorized access to sensitive files like /etc/passwd, /etc/shadow, or SAM database. This rule specifically looks for the hermes-agent process attempting to access these sensitive files, indicating a potential exploit attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-04-29
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7397/
tags:
  - attack.privilege_escalation
  - attack.t1574.006
logsource:
    category: process_creation
detection:
  selection:
      Image|contains:
          - 'hermes-agent'
      TargetFilename|contains:
          - '/etc/passwd'
          - '/etc/shadow'
          - 'C:\Windows\System32\config\SAM'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse