Aws Client VPN vulnerabilities

2 CVEs affecting Aws Client VPN, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-11462, published 2025-10-07.

More from Aws.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-11462, published 2025-10-07. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the…
• CVE-2025-8069, published 2025-07-23. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL…