CVE-2021-3824: Openvpn Access Server

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.

Affected products

• Openvpn Openvpn Access Server: from 2.9.0, up to and including 2.9.4

Published 2021-09-23. Last modified 2026-06-17.