CVE-2026-84732

openvpn: OpenVPN: Remote Denial of Service via crafted ACK packets

Published Sep 7, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

Analysis

Technical impact

The vulnerability is caused by retransmissions of ACK packet IDs in OpenVPN versions 2.6.22 and 2.7.6. Crafted ACK packets trigger a timeout integer overflow that forces the VPN process to fail, resulting in a denial of service for remote users. The flaw allows unauthenticated attackers to disrupt VPN services without authentication, impacting network availability.

Affected Systems

OpenVPN customers running software versions 2.6.22 or 2.7.6 are affected. These versions are commonly deployed in corporate and remote‑access environments.

Risk and Exploitability

The CVSS score of 8.7 categorises this as a high‑severity flaw. No EPSS score is available, and the vulnerability is not yet listed in CISA KEV, but the type of exploit—remote crafted packet injection—suggests a realistic threat if network traffic can be manipulated. An attacker can send malformed ACK packets from any location on the network to trigger the integer overflow and cause a service crash.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenVPN

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.6.22
`0`	affected	≤ 2.7.6

No data.

Vendor Product Versions

Openvpn

Version	Status	Scheme	Platform
`[0,2.6.22]`	affected	semver	—
`[0,2.7.6]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OpenVPN to a fixed release that addresses CVE‑2026‑84732 (e.g., 2.7.7 or later).
If an upgrade cannot be performed immediately, configure firewalls or IDS to detect and block anomalous ACK packet patterns or rate‑limit incoming ACK traffic to mitigate the overflow trigger.
Continuously monitor VPN logs and network traffic for repeated re‑establishment attempts or timeout spikes, and isolate affected hosts during the remediation window to contain potential disruptions.

Generated by OpenCVE AI on September 7, 2026 at 13:53 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8852-1	OpenVPN vulnerabilities

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.342% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://community.openvpn.net/Security%20Announcements/CVE-2026-84732
https://nvd.nist.gov/vuln/detail/CVE-2026-84732
https://www.cve.org/CVERecord?id=CVE-2026-84732

History

Sep 8, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 7, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openvpn Openvpn openvpn
Vendors & Products		Openvpn Openvpn openvpn

Sep 7, 2026 12:15 PM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		openvpn: OpenVPN: Remote Denial of Service via crafted ACK packets
References		https://nvd.nist.gov/vuln/detail/CVE-2026-84732 https://www.cve.org/CVERecord?id=CVE-2026-84732
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 7, 2026 8:45 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow
Weaknesses		CWE-190
References		https://community.openvpn.net/Security%20Announcements/CVE-2026-84732
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L'}`