OpenVPN
Vulnerability activity for OpenVPN: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 15
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 30
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.7MediumOct 28, 2026OpenVPN ovpn-dco-win Denial of serviceCVE-2026-115402OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.
- 6.3MediumOct 22, 2026OpenVPN 3 Core Library Crypto / certificateCVE-2026-106017Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.
- 7.2HighOct 14, 2026OpenVPN Memory corruptionCVE-2026-84471The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
- 7.1HighOct 13, 2026OpenVPN Memory corruptionCVE-2026-88964An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
- 6.9MediumOct 13, 2026OpenVPN ovpn-dco-winCVE-2026-105390Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.
- 7.6HighOct 13, 2026OpenVPNCVE-2026-84790OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
- 6.8MediumSep 7, 2026OpenVPN ovpn-dco-win Memory corruptionCVE-2026-82325A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages
- 8.7HighSep 7, 2026OpenVPN Memory corruptionCVE-2026-84732Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow
- 7.7HighSep 7, 2026OpenVPN Code / command injectionCVE-2026-84256An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject
- 8.5HighSep 7, 2026OpenVPNCVE-2026-84226OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps
- 1.8LowSep 7, 2026OpenVPN Denial of serviceCVE-2026-82312OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects
- 5.6MediumSep 7, 2026OpenVPN Path traversal / file handlingCVE-2026-81830The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation
- 2.3LowSep 7, 2026OpenVPN Memory corruptionCVE-2026-81738OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries
- 5.9MediumSep 7, 2026OpenVPN Memory corruptionCVE-2026-78221An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs.
- 5.6MediumSep 7, 2026OpenVPN Path traversal / file handlingCVE-2026-78043The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths
- 9.1CriticalJul 30, 2026openvpn Memory corruptionCVE-2026-13379The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process
- 8.1HighJul 30, 2026openvpn Memory corruptionCVE-2026-13117An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage
- 8.1HighJul 30, 2026openvpn Memory corruptionCVE-2026-12996A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry
- 8.1HighJul 30, 2026openvpn Denial of serviceCVE-2026-12932A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets
- 7.5HighJul 30, 2026openvpn Memory corruptionCVE-2026-11771OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server
- 7.5HighJul 8, 2026openvpn access serverCVE-2025-3110OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy
- 5.3MediumJul 6, 2026openvpn Denial of serviceCVE-2026-13122OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
- 7.5HighJul 6, 2026openvpn Denial of serviceCVE-2026-13698A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service
- 6.5MediumJun 10, 2026Openvpn ovpn-dco-win Memory corruptionCVE-2026-11604An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).
- 7.4HighJun 8, 2026openvpn Memory corruptionCVE-2026-40215A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.
- 6.5MediumJun 8, 2026openvpn Denial of serviceCVE-2026-35058Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.
- 7.8HighMay 26, 2026Openvpn connect Code / command injectionCVE-2026-9560Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel
- 7.5HighDec 3, 2025openvpn Denial of serviceCVE-2025-13086Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client
- 5.5MediumDec 3, 2025openvpn Denial of serviceCVE-2025-13751Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.
- 9.1CriticalDec 1, 2025openvpn Memory corruptionCVE-2025-12106Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses
- 9.8CriticalJul 8, 2024openvpnCVE-2024-27903OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.8.9% likely
- 7.5HighJul 8, 2024openvpnCVE-2024-24974The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.9.8% likely
Top products
- OpenVPN23 CVEs in the last year, 2 critical
- ovpn-dco-win4 CVEs in the last year
- openvpn access server1 CVE in the last year
- OpenVPN 3 Core Library1 CVE in the last year
- connect1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.