CVE-2024-27903: Openvpn

Critical severity, CVSS 9.8. EPSS: 8.9% chance of exploitation in the next 30 days.

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

Affected products

• Openvpn Openvpn: before 2.5.10 (fixed in 2.5.10); from 2.6.0, before 2.6.10 (fixed in 2.6.10)

Published 2024-07-08. Last modified 2026-06-17.