CVE-2026-84256: Openvpn

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject

Affected products

• Openvpn Openvpn: from 2.1_rc10, up to and including 2.6.22; from 2.7_alpha1, up to and including 2.7.6

Published 2026-09-07. Last modified 2026-09-08.