CVE-2026-81830: Medium severity OpenVPN OpenVPN vulnerability

Q: Which OpenVPN releases should be treated as affected?

OpenVPN versions 2.4.0 through 2.6.22 are affected.

Q: What level of access does an attacker need?

Exploitation requires a local authenticated user account. The issue is not described as remotely exploitable.

Q: How can administrators identify potentially affected systems?

Identify Windows systems running the OpenVPN interactive service and check whether the installed OpenVPN version falls between 2.4.0 and 2.6.22, inclusive.

Published Sep 7, 2026

Updated

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation

Affected Software

1 affected component

OpenVPN OpenVPN>=2.4.0<=2.6.22

Event History

Sep 7, 2026

CVE Published

via MITRE·07:36 AM

Data Sourced

via MITRE·07:36 AM

DescriptionWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which OpenVPN releases should be treated as affected?

OpenVPN versions 2.4.0 through 2.6.22 are affected.

What level of access does an attacker need?

Exploitation requires a local authenticated user account. The issue is not described as remotely exploitable.

How can administrators identify potentially affected systems?