CVE-2023-27516: Softether VPN

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability.

Affected products

• Softether VPN: version 4.41-9782 only; version 5.01.9674 only

Published 2023-10-12. Last modified 2026-06-17.