OpenVPN CVE-2025-13086

Affects OpenVPN community edition 2.6.0 through 2.6.15 and all 2.7 pre-releases (alpha1 through rc1). Exploitation requires the attacker to send session-opening traffic from a source IP that did not initiate the original connection, abusing improper source-IP validation; the CVSS AT:P (attack requirement present) and AC:H indicate success depends on specific timing and/or network positioning to spoof or inject packets matching an existing client association. No authentication and no user interaction are required (PR:N/UI:N), but the impact is limited to denial of service against the originating client - there is no confidentiality or integrity effect and no server compromise. Enterprise-standard 2.5.x and earlier are not listed as affected, and a vendor patch limits exposure to unpatched deployments in the named ranges.

This is a genuine but low-priority availability flaw. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) confirms it is unauthenticated and remote but gated by high attack complexity plus a present attack requirement (AT:P) - meaning the attacker must win a race/timing or possess specific network-position conditions to spoof/hijack the source-IP association. Impact is availability-only (VA:H, no confidentiality or integrity), consistent with the described outcome: a denial of service that knocks the legitimate originating client offline. All exploitation signals point low: EPSS is 0.06% (19th percentile), there is no CISA KEV listing, and no public exploit code is referenced. Distros (Ubuntu, Debian, SUSE) rate/track it as medium-priority and have shipped fixes. The one factor that raises attention is prevalence - OpenVPN is one of the most widely deployed VPN stacks - but the difficulty (AC:H + AT:P), DoS-only impact, and vendor-supplied patch make this a routine patch-cycle item, not an emergency. No key signals conflict; the low CVSS and low EPSS are mutually consistent.

An attacker positioned to spoof or inject traffic against an OpenVPN server sends a crafted packet from a different source IP, exploiting improper source-IP validation to open/hijack a session association that the legitimate client never initiated. This desynchronizes the server's view of the client, causing the originating client's tunnel to drop (denial of service). No public exploit code is identified, and the AT:P/AC:H metrics indicate the attacker needs favorable timing or network positioning to succeed.