OP
Product
OpenVPN
64
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 8High 27Medium 13Low 5
Watch
Add OpenVPN to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-10680 | 8.8 | Oct 24 | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use Affected: 2.7_alpha1 through 2.7_beta1 |
| CVE-2024-4877 | 8.8 | Apr 3 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it… Affected: 2.4.0 through 2.6.11 |
| CVE-2026-84732 | 8.7 | Sep 7 | Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout… Affected: through 2.6.22; through 2.7.6 |
| CVE-2026-84226 | 8.5 | Sep 7 | OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps Affected: 2.5.0 through 2.6.22; 2.7_alpha1 through 2.7.6 |
| CVE-2026-12932 | 8.1 | Jul 30 | A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory… Affected: 2.5.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2026-12996 | 8.1 | Jul 30 | A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted… Affected: 2.6.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2026-13117 | 8.1 | Jul 30 | An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion,… Affected: 2.6.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2024-27459 | 7.8 | Jul 8 | The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges Affected: before 2.5.10; 2.6.0 before 2.6.10 |
| CVE-2021-3606 | 7.8 | Jul 2 | OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run… Affected: before 2.5.3 |
| CVE-2018-9336 | 7.8 | May 1 | openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the… Affected: 2.4.0 before 2.4.6 |
| CVE-2026-84256 | 7.7 | Sep 7 | An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted… Affected: 2.1_rc10 through 2.6.22; 2.7_alpha1 through 2.7.7 |
| CVE-2026-84790 | 7.6 | Oct 13 | OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field Affected: 2.7_alpha1 through 2.7.7 |
| CVE-2026-11771 | 7.5 | Jul 30 | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via… Affected: 2.1.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2026-13698 | 7.5 | Jul 6 | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to… Affected: 2.5.0 through 2.5.11; 2.6.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2025-13086 | 7.5 | Dec 3 | Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address… Affected: 2.6.0 through 2.6.15; 2.7_alpha1 through 2.7_rc1 |
| CVE-2025-2704 | 7.5 | Apr 2 | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the… Affected: 2.6.1 through 2.6.13 |
| CVE-2024-24974 | 7.5 | Jul 8 | The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged… Affected: before 2.5.10; 2.6.0 before 2.6.10 |
| CVE-2023-46849 | 7.5 | Nov 11 | Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an… Affected: 2.6.0 through 2.6.6 |
| CVE-2020-20813 | 7.5 | Aug 22 | Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet Affected: through 2.4.7 |
| CVE-2020-15078 | 7.5 | Apr 26 | OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can… Affected: before 2.4.11; 2.5.0 before 2.5.2 |
| CVE-2017-7508 | 7.5 | Jun 27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet Affected: through 2.3.16; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +3 more |
| CVE-2017-7478 | 7.5 | May 15 | OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet Affected: 2.3.12; 2.3.13; 2.3.14; 2.4.0; 2.4.0; 2.4.0; +4 more |
| CVE-2026-40215 | 7.4 | Jun 8 | A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free… Affected: 2.6.0 through 2.6.19; 2.7_alpha1 through 2.7.1 |
| CVE-2021-3547 | 7.4 | Jul 12 | OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same… Affected: 3.6; 3.6.1 |
| CVE-2017-7520 | 7.4 | Jun 27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker Affected: through 2.3.16; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +3 more |
| CVE-2026-84471 | 7.2 | Oct 14 | The fix for CVE-2026-12996 was incomplete Affected: 2.6.0 through 2.6.22; 2.7_alpha1 through 2.7.7 |
| CVE-2026-88964 | 7.1 | Oct 13 | An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via… Affected: 2.7_alpha3 through 2.7.7 |
Showing 27