OpenVPN Patches 7 High-Severity Flaws Exposing VPN Connections

Key Takeaways

• OpenVPN has released version 2.7.7, a critical update addressing seven high-severity vulnerabilities.
• The flaws primarily impact Windows installations, with one significant vulnerability affecting all supported platforms (Linux, Windows, macOS).
• Vulnerabilities range from denial-of-service (DoS) conditions and buffer overreads to configuration bypasses that could enable unauthorized VPN configurations.
• Users are urged to update immediately to mitigate risks, particularly those operating OpenVPN on Windows.

OpenVPN Patches Seven High-Severity Flaws Across Core and Windows Components

OpenVPN has rolled out a crucial security update, version 2.7.7, on September 3, 2026, to address seven high-severity vulnerabilities. These flaws impact both the software’s fundamental reliability layer and specific Windows service components, presenting risks from denial-of-service (DoS) to unauthorized configuration execution.

Cross-Platform Vulnerability in Reliability Layer

The most far-reaching vulnerability, identified as CVE-2026-84732, resides within OpenVPN’s reliability layer. This critical component is responsible for managing TLS handshakes and acknowledgment packets. Security researcher Mark Bregman of Fox-IT uncovered this flaw, which consists of two distinct issues: an unbounded reliable TLS timeout and improper handling of acknowledgments for packets that were never legitimately outstanding. Given its presence in the shared reliability layer, the patch for CVE-2026-84732 benefits all OpenVPN deployments across Linux, Windows, and macOS.

Windows-Specific Flaws Uncovered

The majority of the patched vulnerabilities—six out of seven—specifically target OpenVPN installations on Windows. This highlights a concentration of edge-case weaknesses within OpenVPN’s Windows service architecture.

Command Execution and Path Manipulation

CVE-2026-84256 addresses an issue with incorrect command-line quoting within the CreateProcess() function. Attackers could exploit this by combining special characters with a validation script and a rogue certificate authority (CA) to induce unexpected behavior. A related flaw, CVE-2026-84226, was found in the tapctl utility. Researchers at BreachX Zero Day Labs, utilizing their Typhon AI Mil v2 tooling, discovered that tapctl invoked netsh.exe without specifying its full file path, creating a potential avenue for binary hijacking or path abuse.

Local Privilege Abuse and Denial of Service

Local privilege abuse was also a concern. CVE-2026-82312 stemmed from OpenVPN’s use of NULL discretionary access control lists (DACLs) on system objects, including the service exit event and the netsh.exe guard semaphore. This design oversight could lead to a local denial-of-service scenario, allowing one logged-in user to disrupt another user’s OpenVPN session by interfering with the semaphore or triggering spurious events. This particular issue affects setups that bypass the interactive service or rely on the automatic Windows service.

Buffer Overreads and Configuration Bypass

Two additional Windows-specific vulnerabilities affected openvpnserv, the core Windows service component. CVE-2026-78221 involved a buffer overread when processing internationalized domain names (IDNs) using UTF-8 encoding, due to an incorrect NRPT domain size passed to the function. Separately, CVE-2026-78043 exposed a critical flaw in openvpnserv’s configuration path validation. The validation failed to block forward slashes, which Windows file-open APIs treat as valid path separators. This mismatch could allow an attacker to bypass administrative restrictions and force openvpn.exe to execute unauthorized configuration files.

Rounding out the list of fixes, CVE-2026-81738 resolved an off-by-one error in the write_dhcp_search_str() function. Researchers Andre Kropp of Nexory and ChinhNguyen are credited with discovering this bug, where specially crafted DHCP search-domain options could cause a single-byte overflow in a temporary buffer.

Beyond these CVE fixes, OpenVPN 2.7.7 introduces a Linux-specific enhancement suggested by researcher Joshua Rogers, which validates netlink replies against the originating request. The release also reduces the number of future keys retained under the EPOCH data-channel format from sixteen to four, aiming to decrease log noise and resource usage on high-throughput connections. Several other networking bug fixes are included, addressing issues in TCP handshakes, UDP checksum handling, and OpenSSL’s HMAC key management.

What You Should Do

• Update Immediately: All OpenVPN users, especially those on Windows, should update to version 2.7.7 without delay.
• Prioritize Windows Systems: Given the concentration of local-privilege and configuration-bypass flaws, Windows administrators should prioritize this update.
• Review Release Notes: Consult the OpenVPN Community Wiki’s security announcements page for full CVE details and release notes.
• Monitor for Anomalies: After updating, monitor your OpenVPN logs and system behavior for any unusual activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.