Vulnerability · Published Feb 16, 2026 · Assigned by VulDB

CVE-2026-2542Total VPN win-service.exe unquoted search path

High 7.0

In plain English

A high-severity security flaw in Total VPN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.2%top 92.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\Program Files\Total VPN\win-service.exe. Executing a manipulation can lead to unquoted search path. It is possible to launch the attack on the local host. This attack is characterized by high complexity. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	Total VPN	0.5.29.0

Weakness: CWE-428, CWE-426 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R

References

VDB-346127 | Total VPN win-service.exe unquoted search path vdb-entry
VDB-346127 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #749365 | Total VPN Total VPN for Windows 0.5.29.0 Unquoted Service Path third-party-advisory
https://github.com/Cyber-Wo0dy/report/blob/main/totalvpn/0.5.29.0/totalvpn_unquoted_service_path.md related