Known vulnerabilities in OpenVPN Server

Vendor: OpenVPN
Software CPE: cpe:2.3:a:openvpn_net:openvpn_server:*:*:*:*:*:*:*:*
Total vulnerabilities: 17
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting OpenVPN Server OpenVPN Server is affected by 17 known vulnerabilities: 11 medium, 6 low Critical High Medium Low

Vulnerabilities (17)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU147005 - Resource exhaustion
CVE-2026-84732
CWE-400 Medium
No
No
2.7.7 05.09.2026 SB2026090525
#VU147006 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-84256
CWE-78 Low
No
No
2.7.7 05.09.2026 SB2026090525
#VU147007 - Untrusted Search Path
CVE-2026-84226
CWE-426 Low
No
No
2.7.7 05.09.2026 SB2026090525
#VU147008 - Incorrect Permission Assignment for Critical Resource
CVE-2026-82312
CWE-732 Low
No
No
2.7.7 05.09.2026 SB2026090525
#VU147009 - Out-of-bounds read
CVE-2026-78221
CWE-125 Medium
No
No
2.7.7 05.09.2026 SB2026090525
#VU147010 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-78043
CWE-22 Low
No
No
2.7.7 05.09.2026 SB2026090525
#VU147011 - Off-by-one Error
CVE-2026-81738
CWE-193 Medium
No
No
2.7.7 05.09.2026 SB2026090525
#VU139870 - Use After Free
CVE-2026-12996
CWE-416 Medium
No
No
2.6.21, 2.7.5 02.07.2026 SB2026072869
SB2026072873
SB2026072874
and 5 more
#VU139871 - Use After Free
CVE-2026-13117
CWE-416 Medium
No
No
2.6.21, 2.7.5 02.07.2026 SB2026072869
SB2026072873
SB2026072874
and 3 more
#VU139872 - Improper input validation
CVE-2026-13122
CWE-20 Medium
No
No
2.6.21, 2.7.5 02.07.2026 SB2026072869
SB2026072873
SB2026072874
and 4 more
#VU139873 - Missing release of memory after effective lifetime
CVE-2026-12932
CWE-401 Medium
No
No
2.6.21, 2.7.5 02.07.2026 SB2026072869
SB2026072873
SB2026072874
and 4 more
#VU139874 - Out-of-bounds write
CVE-2026-11771
CWE-787 Medium
No
No
2.6.21, 2.7.5 02.07.2026 SB2026072869
SB2026072873
SB2026072874
and 3 more
#VU139875 - Missing release of memory after effective lifetime
CVE-2026-13698
CWE-401 Medium
No
No
2.6.21, 2.7.5 02.07.2026 SB2026072869
SB2026072873
SB2026072874
and 5 more
#VU127529 - Improper input validation
CVE-2026-35058
CWE-20 Low
No
No
2.6.20, 2.7.2 24.04.2026 SB20260424124
SB20260424129
SB20260424130
and 14 more
#VU127528 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2026-40215
CWE-362 Low
No
No
2.6.20, 2.7.2 24.04.2026 SB20260424124
SB20260424129
SB20260424130
and 14 more
#VU118819 - Insufficient Verification of Data Authenticity
CVE-2025-13086
CWE-345 Medium
No
No
2.6.16 27.11.2025 SB2025112769
SB2025112771
SB2025112840
and 4 more
#VU106925 - Reachable Assertion
CVE-2025-2704
CWE-617 Medium
No
No
2.6.14 03.04.2025 SB2025040316
SB2025040322
SB2025040323
and 6 more