Every CVE Search/ Get API key

CVE-2026-84732

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated...

8.7 HighFix available

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.34%Down 0.2 points since Sep 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

Record
CVE-2026-84732
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2026-72302 8.7

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

Record
EUVD-2026-72302
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-6r5j-cp22-59fv 8.7

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated...

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

Record
GHSA-6r5j-cp22-59fv
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-190
Updated
2026-11-02
NVD 8.7

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

Record
CVE-2026-84732
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2026-84732 8.7

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

Record
ALPINE-CVE-2026-84732
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVDEBIAN-CVE-2026-84732 8.7

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

Record
DEBIAN-CVE-2026-84732
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 12 moreShow less
OSVOESA-2026-4095 7.5

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow(CVE-2026-84732)

Record
OESA-2026-4095
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-4096 7.5

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow(CVE-2026-84732)

Record
OESA-2026-4096
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-4097 7.5

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow(CVE-2026-84732)

Record
OESA-2026-4097
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-84732 8.7

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

Record
UBUNTU-CVE-2026-84732
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Updated
2026-11-02
OSVCLSA-2026-1792649282 No score

Fix CVE(s): CVE-2026-84732

  • SECURITY UPDATE: Remote denial of service via TLS retransmit timeout integer overflow
    • debian/patches/CVE-2026-84732.patch: cap the exponential backoff of the reliable layer retransmit timeout, limit --tls-timeout and ignore ACKs for packet IDs outside the send window in src/openvpn/options.c, src/openvpn/reliable.c, src/openvpn/reliable.h
    • CVE-2026-84732
  • UPDATE CERTIFICATES: Renew sample keys
    • debian/patches/sample-keys-renew.patch: Renew sample keys for 10 years
Record
CLSA-2026-1792649282
Updated
2026-11-02
OSVMGASA-2026-0498 No score

Updated openvpn package fixes security vulnerabilities

Improve on check_session_buf_not_used(), catch possible double-free in the lame duck case. (CVE-2026-84471) Reliability layer: avoid unbounded reliable TLS timeout, and ignore acks for packets that cannot be outstanding. (CVE-2026-84732)

Record
MGASA-2026-0498
Updated
2026-11-02
OSVopenSUSE-SU-2026:22072-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
openSUSE-SU-2026:22072-1
Updated
2026-11-02
OSVSUSE-SU-2026:24220-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
SUSE-SU-2026:24220-1
Updated
2026-11-02
OSVSUSE-SU-2026:4213-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
SUSE-SU-2026:4213-1
Updated
2026-11-02
OSVSUSE-SU-2026:4217-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
SUSE-SU-2026:4217-1
Updated
2026-11-02
OSVSUSE-SU-2026:4242-1 No score

Security update for openvpn

This update for openvpn fixes the following issue:

  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
SUSE-SU-2026:4242-1
Updated
2026-11-02
OSVUSN-8852-1 No score

openvpn vulnerabilities

It was discovered that OpenVPN had a use-after-free vulnerability in its TLS session handling. An attacker could possibly use this issue to cause OpenVPN to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-84471)

It was discovered that OpenVPN incorrectly handled retransmissions of ACK packet IDs, which could trigger a timeout integer overflow. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-84732)

Record
USN-8852-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openvpn
Alpine:v3.24
 before 2.7.7-r0
2.7.7-r0
openvpn
TuxCare:Ubuntu:20.04
 before 2.4.12-0ubuntu0.20.04.2+tuxcare.els1
2.4.12-0ubuntu0.20.04.2+tuxcare.els1
openvpn
Debian:12
 All versions, plus listed versions
2.6.11-12.6.12-12.6.13-12.6.14-0+deb12u12.6.14-0+deb12u2
Show 38 moreShow less
2.6.14-12.6.14-22.6.15-12.6.3-12.6.3-1+deb12u12.6.3-1+deb12u1~bpo11+12.6.3-1+deb12u22.6.3-1+deb12u2~bpo11+12.6.3-1+deb12u32.6.3-1+deb12u42.6.3-22.6.3-2.12.6.7-12.6.9-12.7.0-12.7.0-1~bpo13+12.7.0~alpha1-12.7.0~alpha2-12.7.0~alpha3-12.7.0~beta1-12.7.0~beta2-12.7.0~beta3-12.7.0~rc1-12.7.0~rc2-12.7.0~rc2-22.7.0~rc3-12.7.0~rc4-12.7.0~rc5-12.7.0~rc6-12.7.1-12.7.1-1~bpo13+12.7.2-12.7.2-1~bpo13+12.7.3-12.7.5-12.7.5-1~bpo13+12.7.7-12.7.7-1~bpo13+1
 None known
openvpn
Debian:13
 All versions, plus listed versions
2.6.14-12.6.14-1+deb13u12.6.14-1+deb13u22.6.14-1+deb13u32.6.14-2
Show 25 moreShow less
2.6.15-12.7.0-12.7.0-1~bpo13+12.7.0~alpha1-12.7.0~alpha2-12.7.0~alpha3-12.7.0~beta1-12.7.0~beta2-12.7.0~beta3-12.7.0~rc1-12.7.0~rc2-12.7.0~rc2-22.7.0~rc3-12.7.0~rc4-12.7.0~rc5-12.7.0~rc6-12.7.1-12.7.1-1~bpo13+12.7.2-12.7.2-1~bpo13+12.7.3-12.7.5-12.7.5-1~bpo13+12.7.7-12.7.7-1~bpo13+1
 None known
openvpn
Debian:14
 before 2.7.7-1, plus listed versions
2.6.14-12.6.14-22.6.15-12.7.0-12.7.0-1~bpo13+1
Show 21 moreShow less
2.7.0~alpha1-12.7.0~alpha2-12.7.0~alpha3-12.7.0~beta1-12.7.0~beta2-12.7.0~beta3-12.7.0~rc1-12.7.0~rc2-12.7.0~rc2-22.7.0~rc3-12.7.0~rc4-12.7.0~rc5-12.7.0~rc6-12.7.1-12.7.1-1~bpo13+12.7.2-12.7.2-1~bpo13+12.7.3-12.7.5-12.7.5-1~bpo13+12.7.7-1~bpo13+1
2.7.7-1
openvpn
Mageia:10
From an advisory covering 2 CVEs
 before 2.6.23-1.mga10
2.6.23-1.mga10
openvpn
openEuler:24.03-LTS-SP1
 before 2.6.9-10.oe2403sp1
2.6.9-10.oe2403sp1
openvpn
openEuler:24.03-LTS-SP3
 before 2.6.9-10.oe2403sp3
2.6.9-10.oe2403sp3
openvpn
openEuler:24.03-LTS-SP4
 before 2.6.9-10.oe2403sp4
2.6.9-10.oe2403sp4
openvpn
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1
Show 28 moreShow less
Affected packages
PackageAffectedFixed
openvpn
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1
openvpn
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.37.1
2.6.10-150600.3.37.1
openvpn-dco
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.37.1
2.6.10-150600.3.37.1
openvpn
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.37.1
2.6.10-150600.3.37.1
openvpn-dco
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.37.1
2.6.10-150600.3.37.1
openvpn
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.37.1
2.6.10-150600.3.37.1
openvpn-dco
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.37.1
2.6.10-150600.3.37.1
openvpn
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 2.5.6-150400.3.28.1
2.5.6-150400.3.28.1
openvpn
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.5.6-150400.3.28.1
2.5.6-150400.3.28.1
openvpn
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 2.5.6-150400.3.28.1
2.5.6-150400.3.28.1
openvpn
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 2.5.6-150400.3.28.1
2.5.6-150400.3.28.1
openvpn
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.5.6-150400.3.28.1
2.5.6-150400.3.28.1
openvpn
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 2.5.6-150400.3.28.1
2.5.6-150400.3.28.1
openvpn
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 2.5.6-150400.3.28.1
2.5.6-150400.3.28.1
openvpn
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 2.5.6-150400.3.28.1
2.5.6-150400.3.28.1
openvpn
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 2.3.8-16.38.1
2.3.8-16.38.1
openvpn
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.3.8-16.38.1
2.3.8-16.38.1
openvpn
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.3.2-4ubuntu12.3.2-5ubuntu12.3.2-7ubuntu12.3.2-7ubuntu22.3.2-7ubuntu3
Show 4 moreShow less
2.3.2-7ubuntu3.12.3.2-7ubuntu3.22.3.2-7ubuntu3.2+esm12.3.2-7ubuntu3.2+esm2
 None known
openvpn
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.3.7-1ubuntu12.3.7-2ubuntu12.3.8-1ubuntu12.3.10-1ubuntu12.3.10-1ubuntu2
Show 4 moreShow less
2.3.10-1ubuntu2.12.3.10-1ubuntu2.22.3.10-1ubuntu2.2+esm12.3.10-1ubuntu2.2+esm2
 None known
openvpn
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.3-4ubuntu12.4.4-1ubuntu12.4.4-2ubuntu12.4.4-2ubuntu1.12.4.4-2ubuntu1.2
Show 5 moreShow less
2.4.4-2ubuntu1.32.4.4-2ubuntu1.52.4.4-2ubuntu1.62.4.4-2ubuntu1.72.4.4-2ubuntu1.7+esm1
 None known
openvpn
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.4.7-1ubuntu22.4.7-1ubuntu2.20.04.22.4.7-1ubuntu2.20.04.32.4.7-1ubuntu2.20.04.42.4.12-0ubuntu0.20.04.12.4.12-0ubuntu0.20.04.2
 None known
openvpn
Ubuntu:22.04:LTS
 before 2.5.11-0ubuntu0.22.04.5, plus listed versions
2.5.1-3ubuntu12.5.1-3ubuntu22.5.1-3ubuntu42.5.1-3ubuntu52.5.5-1ubuntu1
Show 7 moreShow less
2.5.5-1ubuntu32.5.5-1ubuntu3.12.5.9-0ubuntu0.22.04.22.5.9-0ubuntu0.22.04.32.5.11-0ubuntu0.22.04.12.5.11-0ubuntu0.22.04.32.5.11-0ubuntu0.22.04.4
2.5.11-0ubuntu0.22.04.5
openvpn
Ubuntu:24.04:LTS
 before 2.6.19-0ubuntu0.24.04.4, plus listed versions
2.6.5-0ubuntu12.6.7-1ubuntu12.6.9-1ubuntu22.6.9-1ubuntu32.6.9-1ubuntu4
Show 9 moreShow less
2.6.9-1ubuntu4.12.6.12-0ubuntu0.24.04.12.6.12-0ubuntu0.24.04.32.6.14-0ubuntu0.24.04.12.6.14-0ubuntu0.24.04.22.6.14-0ubuntu0.24.04.32.6.19-0ubuntu0.24.04.12.6.19-0ubuntu0.24.04.22.6.19-0ubuntu0.24.04.3
2.6.19-0ubuntu0.24.04.4
openvpn
Ubuntu:26.04:LTS
 before 2.7.0-1ubuntu1.3, plus listed versions
2.6.14-2ubuntu12.6.15-1ubuntu12.7.0~rc5-1ubuntu52.7.0~rc6-1ubuntu12.7.0-1ubuntu12.7.0-1ubuntu1.12.7.0-1ubuntu1.2
2.7.0-1ubuntu1.3
openvpn
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 2.5.11-0ubuntu0.22.04.5, plus listed versions
2.5.1-3ubuntu12.5.1-3ubuntu22.5.1-3ubuntu42.5.1-3ubuntu52.5.5-1ubuntu1
Show 7 moreShow less
2.5.5-1ubuntu32.5.5-1ubuntu3.12.5.9-0ubuntu0.22.04.22.5.9-0ubuntu0.22.04.32.5.11-0ubuntu0.22.04.12.5.11-0ubuntu0.22.04.32.5.11-0ubuntu0.22.04.4
2.5.11-0ubuntu0.22.04.5
openvpn
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 2.6.19-0ubuntu0.24.04.4, plus listed versions
2.6.5-0ubuntu12.6.7-1ubuntu12.6.9-1ubuntu22.6.9-1ubuntu32.6.9-1ubuntu4
Show 9 moreShow less
2.6.9-1ubuntu4.12.6.12-0ubuntu0.24.04.12.6.12-0ubuntu0.24.04.32.6.14-0ubuntu0.24.04.12.6.14-0ubuntu0.24.04.22.6.14-0ubuntu0.24.04.32.6.19-0ubuntu0.24.04.12.6.19-0ubuntu0.24.04.22.6.19-0ubuntu0.24.04.3
2.6.19-0ubuntu0.24.04.4
openvpn
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 2.7.0-1ubuntu1.3, plus listed versions
2.6.14-2ubuntu12.6.15-1ubuntu12.7.0~rc5-1ubuntu52.7.0~rc6-1ubuntu12.7.0-1ubuntu12.7.0-1ubuntu1.12.7.0-1ubuntu1.2
2.7.0-1ubuntu1.3
openvpn
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-84732 is a high vulnerability (CVSS 8.7) in Openvpn, published September 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in openvpn 2.7.7-r0.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open