CVE-2026-84790: OpenVPN OpenVPN vulnerability

Q: Which installations are in scope for triage?

Installations running OpenVPN versions 2.3.0 through 2.6.22, or 2.7_alpha1 through 2.7.7, are affected. Prioritize deployments where remote authenticated users can connect.

Q: What does an attacker need to exploit this issue?

The attacker must be a remote authenticated user and use a crafted certificate subject field. The reported impact is impersonation of other users.

Published Oct 13, 2026

Updated

OpenVPN 2.3.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

Affected Software

1 affected component

OpenVPN OpenVPN>=2.3.0<=2.6.22, >=2.7_alpha1<=2.7.7

Event History

Oct 13, 2026

CVE Published

via MITRE·09:39 PM

Data Sourced

via MITRE·09:39 PM

DescriptionWeakness

Frequently Asked Questions

Which installations are in scope for triage?

Installations running OpenVPN versions 2.3.0 through 2.6.22, or 2.7_alpha1 through 2.7.7, are affected. Prioritize deployments where remote authenticated users can connect.

What does an attacker need to exploit this issue?

The attacker must be a remote authenticated user and use a crafted certificate subject field. The reported impact is impersonation of other users.