Description
An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject
Published: 2026-09-07
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

An argument parsing flaw in OpenVPN permits a remote authenticated user to embed malicious command strings within the certificate subject field. The vulnerability enables the attacker to execute arbitrary commands on the Windows server process that runs OpenVPN, potentially achieving full system compromise. The weakness is a classic command‑injection flaw (CWE‑78) coupled with improper certificate subject handling (CWE‑88).

Affected Systems

The vendor and product affected are OpenVPN, specific to Windows builds. The vulnerable releases include 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity risk, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to be authenticated to the VPN server and must supply a client certificate containing a specially crafted subject string. If accepted, the flaw will trigger command execution within the VPN process context, exposing the system to compromise.

Generated by OpenCVE AI on September 7, 2026 at 13:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest OpenVPN version (2.6.23 or newer) that fixes the certificate subject parsing issue.
  • If an upgrade cannot be performed immediately, disable or restrict client certificate authentication on Windows installations until the patch is applied.
  • Continuously monitor VPN server logs for unexpected command executions and enforce strict certificate validation policies to detect and stop potential exploitation.

Generated by OpenCVE AI on September 7, 2026 at 13:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Openvpn
Openvpn openvpn
Vendors & Products Openvpn
Openvpn openvpn

Mon, 07 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title OpenVPN: OpenVPN: Arbitrary command execution via crafted certificate subject
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Mon, 07 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Description An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject
Weaknesses CWE-78
CWE-88
References
Metrics cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Openvpn Openvpn
cve-icon MITRE

Status: PUBLISHED

Assigner: OpenVPN

Published:

Updated: 2026-09-08T15:00:15.389Z

Reserved: 2026-09-01T13:36:26.707Z

Link: CVE-2026-84256

cve-icon Vulnrichment

Updated: 2026-09-08T15:00:11.642Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-07T08:17:13.777

Modified: 2026-09-08T19:07:52.113

Link: CVE-2026-84256

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-07T07:55:27Z

Links: CVE-2026-84256 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T16:00:13Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  • CWE-88

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')