CVE-2026-84790: High severity OpenVPN OpenVPN vulnerability
Published Oct 13, 2026
·Updated
OpenVPN 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
Affected Software
2 affected componentsFixes available
OpenVPN OpenVPN>=2.7_alpha1<=2.7.7
debian/openvpn<=2.6.14-0+deb12u2, <=2.6.14-1+deb13u3
2.7.8-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.7.8-1
Event History
Oct 13, 2026
CVE Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·09:39 PM
Data Sourced
via MITRE·09:39 PM
DescriptionWeakness
Data Sourced
via NVD·10:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are in scope for triage?
Installations running OpenVPN versions 2.3.0 through 2.6.22, or 2.7_alpha1 through 2.7.7, are affected. Prioritize deployments where remote authenticated users can connect.
2
What does an attacker need to exploit this issue?
The attacker must be a remote authenticated user and use a crafted certificate subject field. The reported impact is impersonation of other users.