Skip to main content

OpenVPN CVE-2026-13122

| EUVDEUVD-2026-41880 MEDIUM
Reachable Assertion (CWE-617)
2026-07-02 GHSA-m5x7-29rp-3xmr
Information Disclosure Microsoft Red Hat Openvpn Suse
5.9
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
5.9 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable DoS via assertion requires low-privilege auth and high-complexity timing; no confidentiality or integrity impact applies.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

4
Analysis Generated
Jul 06, 2026 - 16:50 vuln.today
CVSS changed
Jul 06, 2026 - 16:22 NVD
5.9 (MEDIUM)
CVE Published
Jul 02, 2026 - 10:57 github-releases
UNKNOWN (no severity yet)
CVE Published
Jul 02, 2026 - 10:57 github-releases
MEDIUM 5.9

Description PRE-NVD

Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.

AnalysisAI

Denial-of-service in OpenVPN via a reachable assertion (CWE-617) allows a remote, low-privileged attacker to crash the OpenVPN daemon under high-complexity, timing-specific conditions. All OpenVPN deployments running versions prior to v2.7.5 are affected; the fix is available in the v2.7.5 release disclosed pre-NVD via GitHub. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.9 (Medium) reflects the constrained exploitation path, though VPN service disruption carries meaningful operational impact for affected operators.

Technical ContextAI

CWE-617 (Reachable Assertion) identifies code paths where a runtime assert() or equivalent guard statement can be triggered by attacker-controlled input, causing the process to abort unconditionally. In OpenVPN, the vulnerability is reachable via the network-facing control channel under specific timing and packet-sequence conditions, as reflected by the CVSS 4.0 vector metrics AV:N/AC:H/AT:P. The AT:P (Attack Requirements: Present) metric confirms that specific preconditions beyond a default network connection are required. No CPE strings were included in the provided intelligence; the canonical product is openvpn:openvpn as tracked by NVD. The v2.7.5 release also addresses two distinct CVEs in the same package: CVE-2026-13379 (DNS SearchList state pollution in openvpnserv on Windows via --dns config interactions) and CVE-2026-12996 (use-after-free in ack_write_buf() triggered by a well-timed control channel and authentication packet sequence). CVE-2026-13122 is distinct from both of those; its precise code location is not confirmed due to truncation of the CVE description.

RemediationAI

Upgrade to OpenVPN v2.7.5 or later, which contains the confirmed fix as published at https://github.com/OpenVPN/openvpn/releases/tag/v2.7.5 and referenced in the vendor security announcement at https://community.openvpn.net/Security%20Announcements/CVE-2026-13122. The v2.7.5 release simultaneously patches CVE-2026-13379 and CVE-2026-12996, making the upgrade a high-priority single action for any OpenVPN deployment. If immediate upgrade is not operationally feasible, restrict access to the OpenVPN control-channel port (typically UDP/1194 or TCP/443) via perimeter firewall rules to allow only known, authorized client IP ranges - this does not eliminate the vulnerability but substantially raises the exploitation bar by reducing the attacker population who can reach the service. Monitor for unexpected OpenVPN daemon restarts or crashes as an indicator of exploitation attempts while patching is in progress.

More in Openvpn

View all
CVE-2018-7544 CRITICAL POC
9.1 Mar 16

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
CVE-2017-7478 HIGH POC
7.5 May 15

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
CVE-2020-9442 HIGH POC
7.8 Feb 28

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
CVE-2018-9336 HIGH POC
7.8 May 01

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2019-25429 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
CVE-2019-25428 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
CVE-2017-12166 CRITICAL
9.8 Oct 04

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
CVE-2024-1305 CRITICAL
9.8 Jul 08

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
CVE-2024-27903 CRITICAL
9.8 Jul 08

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-13122 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy