Vulnerability · Published Sep 7, 2026 · Assigned by OpenVPN
CVE-2026-84256
High 7.7
In plain English
A high-severity OS command injection in OpenVPN from OpenVPN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 4.0)7.7High
Exploit odds (30 days)0.4%top 67.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | openvpn | no fix listed | UBUNTU-CVE-2026-84256 |
| Ubuntu:24.04:LTS | openvpn | no fix listed | UBUNTU-CVE-2026-84256 |
| Ubuntu:26.04:LTS | openvpn | no fix listed | UBUNTU-CVE-2026-84256 |
Affected products (as reported)
Weakness: CWE-78, CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N