Openvpn vulnerabilities

Products

• Openvpn 65
• Access Server 21
• Connect 8
• Connect 7
• Ovpn-dco-win 7
• Access Server 4
• 3 Core Library 3
• Openvpn-gui 3
• Gui 3
• 2 2
• 2 (community) 2

Newest

• openvpn ovpn-dco-win OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of... CVE-2026-115402 5.7 MediumOctober 28, 2026
• openvpn 3 core library Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows... CVE-2026-106017 6.3 MediumOctober 22, 2026
• openvpn ovpn-dco-win Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and... CVE-2026-105390 6.9 MediumOctober 13, 2026
• openvpn OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a... CVE-2026-84790 Fix available 7.6 HighOctober 13, 2026
• openvpn An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows... CVE-2026-88964 Fix available 7.1 HighOctober 8, 2026
• openvpn ovpn-dco-win A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6... CVE-2026-82325 6.8 MediumSeptember 7, 2026
• openvpn Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated... CVE-2026-84732 Fix available 8.7 HighSeptember 7, 2026
• openvpn The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users... CVE-2026-81830 5.6 MediumSeptember 7, 2026
• openvpn The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2... CVE-2026-84471 Fix available 7.2 HighSeptember 4, 2026
• openvpn An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on... CVE-2026-84256 7.7 HighSeptember 4, 2026
• openvpn OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local... CVE-2026-84226 8.5 HighSeptember 4, 2026
• openvpn OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated... CVE-2026-82312 1.8 LowSeptember 4, 2026
• openvpn OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger... CVE-2026-81738 2.3 LowSeptember 4, 2026
• openvpn An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1... CVE-2026-78221 5.9 MediumSeptember 4, 2026
• openvpn The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated... CVE-2026-78043 5.6 MediumSeptember 4, 2026
• openvpn OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be... CVE-2026-63650 2.0 LowAugust 14, 2026
• openvpn The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5... CVE-2026-63649 4.1 MediumAugust 14, 2026
• openvpn The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to... CVE-2026-13379 5.1 MediumJuly 30, 2026
• openvpn access server OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header... CVE-2025-3110 6.9 MediumJuly 8, 2026
• openvpn OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to... CVE-2026-13122 Fix available 5.9 MediumJuly 6, 2026
• openvpn A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1... CVE-2026-13698 Fix available 6.0 MediumJuly 6, 2026
• openvpn An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote... CVE-2026-13117 Fix available 6.0 MediumJuly 3, 2026
• openvpn, debian linux +1 more A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote... CVE-2026-12996 Fix available 6.0 MediumJuly 3, 2026
• openvpn A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2... CVE-2026-12932 Fix available 7.1 HighJuly 3, 2026
• openvpn OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by... CVE-2026-11771 Fix available 7.0 HighJuly 3, 2026
• openvpn ovpn-dco-win An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2... CVE-2026-11604 5.6 MediumJune 10, 2026
• openvpn connect Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS... CVE-2026-9560 Public exploit 9.4 CriticalMay 26, 2026
• openvpn A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote... CVE-2026-40215 Fix available 6.1 MediumApril 23, 2026
• openvpn Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through... CVE-2026-35058 Fix available 6.9 MediumApril 23, 2026
• openvpn ovpn-dco-win Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by... CVE-2026-2738 5.6 MediumFebruary 19, 2026
• openvpn Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote... CVE-2025-15497 Fix available 3.8 LowJanuary 30, 2026
• openvpn Interactive service agent in OpenVPN version 2.5.0 through 2.7_rc2 on Windows allows a local... CVE-2025-13751 1.3 LowDecember 3, 2025
• openvpn Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to... CVE-2025-12106 9.1 CriticalDecember 1, 2025
• openvpn Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.7_rc1 allows an... CVE-2025-13086 Fix available 4.6 MediumNovember 19, 2025
• openvpn access server Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access... CVE-2025-50055 6.4 MediumOctober 27, 2025
• openvpn OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated... CVE-2025-10680 8.8 HighOctober 24, 2025
• openvpn ovpn-dco-win Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier... CVE-2025-50054 5.5 MediumJune 20, 2025
• openvpn 3 linux, openvpn3linux +1 more The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local... CVE-2025-3908 Fix available 6.2 MediumMay 19, 2025
• openvpn OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to... CVE-2024-4877 8.8 HighApril 3, 2025
• openvpn OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to... CVE-2025-2704 Fix available 7.5 HighApril 2, 2025
• openvpn easy-rsa Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more... CVE-2024-13454 Fix available 5.3 MediumJanuary 20, 2025
• openvpn ovpn-dco, openvpn-gui, ovpn-dco-win +2 more OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O... CVE-2024-5198 3.3 LowJanuary 15, 2025
• openvpn connect OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private... CVE-2024-8474 7.5 HighJanuary 6, 2025
• openvpn tap-windows6, openvpn-gui, gui +1 more +3 more tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming... CVE-2024-1305 EPSS 15.4% 9.8 CriticalJuly 8, 2024
• openvpn, openvpn 2, openvpn2 +2 more OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory,... CVE-2024-27903 9.8 CriticalJuly 8, 2024
• openvpn, openvpn 2 +1 more The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be... CVE-2024-24974 7.5 HighJuly 8, 2024
• openvpn, openvpn gui +1 more The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a... CVE-2024-27459 7.8 HighJuly 8, 2024
• openvpn OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which attackers can use to... CVE-2024-5594 Fix available 9.1 CriticalJune 25, 2024
• openvpn OpenVPN 2.6.10 and earlier in a server role accepts multiple exit notifications from... CVE-2024-28882 Fix available 4.3 MediumJune 25, 2024
• openvpn, openvpn gui +1 more The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions... CVE-2023-7235 8.4 HighFebruary 21, 2024
• Show olderLoading…