This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] OpenVPN Connect fixes a critical vulnerability

OpenVPN Connect for macOS version 3.8.2 fixes 1 critical vulnerability [1][2].

OpenVPN Connect - arbitrary command execution (CVE-2026-9560)
CVSS 9.4 (Critical)

An unauthenticated local attacker can, due to an OS command injection vulnerability in the background service component of OpenVPN Connect for macOS, execute arbitrary commands with root privileges via a local IPC channel [1]. To effectively mitigate the risk, it is necessary to update OpenVPN Connect to the fixed version, restrict local access to unpatched systems and monitor anomalies in their IPC communication to prevent the attack from potentially spreading across the network [3].

The vulnerability is present in product:

  • OpenVPN Connect (macOS); >=3.5.1, <=3.8.1

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

More information:

  • CVE-2026-9560 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 26. 5. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 1. 6. 2026.

CESNET, z.s.p.o. Logo