This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] OpenVPN fixes 8 vulnerabilities (7 affect Windows)

OpenVPN fixes 8 vulnerabilities in version 2.7.7, 7 of which affect only Windows instances [1][2][3][4][5][6][7][8]. The most severe vulnerabilities are described below, the rest can be found at [5][6][7][8].

OpenVPN - DoS (CVE-2026-84732)
CVSS 8.7 (High)

An unauthenticated remote attacker can carry out a DoS attack in OpenVPN using specific repeated TLS and TCP communication [1].

The vulnerability is present in product:

  • OpenVPN; ==2.6.22; ==2.7.6;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

More information:

The vulnerability was publicly disclosed 7. 9. 2026.

OpenVPN (Windows) - RCE (CVE-2026-84226)
CVSS 8.5 (High)

An authenticated local attacker can execute arbitrary code in OpenVPN for Windows by planting an attacker-crafted netsh.exe file (binary planting) [3].

The vulnerability is present in product:

  • OpenVPN; >=2.5.0; <2.7.7;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 7. 9. 2026.

OpenVPN (Windows) - command injection (CVE-2026-84256)
CVSS 7.7 (High)

An authenticated remote attacker can execute arbitrary commands in OpenVPN for Windows using a specially crafted certificate [2][9].

The vulnerability is present in product:

  • OpenVPN; >=2.1_rc10; <2.7.7;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2026-84256 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
  • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 9. 2026.

OpenVPN (Windows) - buffer overread (CVE-2026-78221)
CVSS 5.9 (Medium)

An authenticated local attacker can read beyond the bounds of an allocated buffer in OpenVPN for Windows, causing memory corruption or gaining access to potentially sensitive information [4].

The vulnerability is present in product:

  • OpenVPN; >=2.7_alpha1; <2.7.7;

CVSS: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H

More information:

The vulnerability was publicly disclosed 7. 9. 2026.

By CESNET, z.s.p.o. Martin Krajči on 8. 9. 2026.

CESNET, z.s.p.o. Logo