Critical OpenVPN Connect for macOS Bug Lets Attackers Run Commands

Key Takeaways

• A critical privilege escalation vulnerability, CVE-2026-9560, has been discovered in OpenVPN Connect for macOS.
• The flaw allows local attackers to execute arbitrary commands with root privileges through the application’s background service.
• Versions 3.5.1 through 3.8.1 are affected, receiving a CVSS 4.0 score of 9.4 (Critical).
• Users are urged to update immediately to a version beyond 3.8.1 to mitigate the risk.

Critical Flaw in OpenVPN Connect for macOS Allows Local Command Execution

A severe privilege escalation vulnerability has been identified in OpenVPN Connect for macOS, posing a significant risk to users. This critical flaw enables a local attacker to execute arbitrary commands with elevated privileges by exploiting a component of the application’s background service.

Designated as CVE-2026-9560, the vulnerability affects OpenVPN Connect for macOS versions ranging from 3.5.1 up to and including 3.8.1. It has been assigned a CVSS 4.0 base score of 9.4, categorizing it as critical severity.

Technical Details of the Vulnerability

The core of the security issue resides within the OpenVPN Connect’s macOS privileged helper component. This background service operates with elevated system permissions, primarily tasked with managing VPN connections. The vulnerability is classified under CWE-78 (OS Command Injection).

Exploitation of this flaw occurs via a local Inter-Process Communication (IPC) channel. An attacker already present on the system can interact directly with the privileged background service through this channel. This interaction allows for the injection and execution of arbitrary operating system commands as the root user, all without requiring any user interaction.

Security researchers Ismael Esquilichi, Pablo Redondo, and Lê Đức Ninh are credited with the responsible disclosure of this vulnerability. At the time of this report, there are no public proof-of-concept exploits known, nor have there been any confirmed instances of active exploitation in the wild.

Additional Fixes in the Latest OpenVPN Release

In addition to addressing the critical CVE-2026-9560, the latest OpenVPN Connect release also resolves two other bugs:

• Browser Authentication Failure: An issue where server URLs terminating with /, ?, or # prevented the application from launching the browser for web-based authentication has been fixed.
• Blank Profile Import Crash: A user interface bug that caused the manual profile import screen to appear unexpectedly, potentially leading to the import of a blank profile or an application crash when switching profiles, has been resolved.

What You Should Do

Security teams and individual macOS users running OpenVPN Connect must take immediate action to protect their systems:

• Update OpenVPN Connect immediately to the latest version, specifically beyond 3.8.1.
• Restrict local access to all systems that are currently running affected versions of the software.
• Implement monitoring for any unusual IPC communication originating from or targeting OpenVPN background processes.
• Conduct audits of endpoint access controls to reduce the local attack surface on all managed devices.

Considering this is a local privilege escalation flaw, organizations should treat any unpatched endpoint as a potential vector for lateral movement, especially in environments where multiple users share access to macOS systems.</

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.