OpenVPN versions 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 for Windows contain an argument parsing issue that allows a remote authenticated user to execute arbitrary commands via a crafted certificate subject. This flaw reflects a command‑injection weakness (CWE‑78) and improper certificate subject handling (CWE‑88). If exploited, an attacker could run arbitrary code with the privileges of the OpenVPN server process, potentially compromising the host.

The affected vendor is OpenVPN, product OpenVPN, and the impacted releases are the Windows builds of OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7. No other platforms or products are listed in the entry. Administrators should verify the exact version in use against these ranges to determine whether they are impacted.

The CVSS score of 7.7 indicates a high severity, while the EPSS score is listed as < 1%, showing that exploitation attempts are unlikely at the moment. The vulnerability is not recorded in CISA’s KEV catalog. An attacker must first authenticate to the VPN server and then provide a client certificate that contains a specially crafted subject field; if accepted, the vulnerable code will parse the subject and execute the embedded command within the OpenVPN server process context. Because the command runs under the server's privileges, successful exploitation can lead to full system compromise.