CVE-2026-13379: Openvpn

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Affected products

• Openvpn Openvpn: from 2.7, before 2.7.5 (fixed in 2.7.5)

Published 2026-07-30. Last modified 2026-08-05.