Skip to main content

OpenVPN CVE-2026-63649

| EUVDEUVD-2026-58812 MEDIUM
Permissive List of Allowed Inputs (CWE-183)
2026-08-06 GHSA-p428-592p-6c59
Information Disclosure Microsoft
4.1
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
4.1 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.2 LOW

Local socket access requires low privileges (PR:L); scope changes (S:C) due to rogue VPN config affecting downstream systems; confidentiality limited to policy bypass, not arbitrary file read (C:L).

3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
A
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 14, 2026 - 23:26 vuln.today
Analysis Generated
Aug 14, 2026 - 23:26 vuln.today
CVE Published
Aug 06, 2026 - 10:06 github-releases
MEDIUM 4.1
CVE Published
Aug 06, 2026 - 10:06 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.

AnalysisAI

openvpnserv on Windows insufficiently validates command line arguments received from its control socket before passing them to the openvpn.exe process, allowing a low-privileged local user to circumvent administrator-defined restrictions on permitted OpenVPN configuration directories. Affected installations span OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 on Windows; fixed releases 2.6.22 and 2.7.6 shipped August 5, 2026. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 SC:H metric indicates that bypassing config directory controls could allow rogue VPN configurations to be loaded, with high downstream confidentiality impact on subsequent network systems.

Technical ContextAI

openvpnserv is the Windows service component of OpenVPN responsible for spawning and managing openvpn.exe child processes. It exposes a control socket through which connection parameters and command line arguments are submitted by the GUI or user-facing components. CWE-183 (Permissive List of Allowed Inputs) describes the root cause: the service failed to apply sufficient scrutiny to the command line received from this socket before forwarding it to openvpn.exe. On managed Windows deployments, administrators can restrict which configuration file directories OpenVPN is permitted to access - a policy boundary enforced through openvpnserv. The flaw allows this allowlist validation to be bypassed, but the advisory explicitly notes it cannot be used to read files beyond what the OS-level user permissions would ordinarily permit. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N reflects the local attack surface and the downstream confidentiality impact caused by loading rogue configurations.

RemediationAI

Upgrade to OpenVPN 2.6.22 (stable) or OpenVPN 2.7.6 (development branch), both released August 5, 2026 and available via https://github.com/OpenVPN/openvpn/releases/tag/v2.6.22 and https://community.openvpn.net/ReleaseHistory#openvpn-2622-released-5-august-2026. If immediate upgrade is not feasible, restricting local user access to the openvpnserv control socket using Windows ACLs reduces exposure, though this may disrupt legitimate OpenVPN GUI functionality and should be tested before deployment. Environments that have not configured admin-defined config directory restrictions have no active policy boundary being bypassed, though patching remains the recommended remediation regardless. No additional workarounds are described in the vendor advisory.

Same weakness CWE-183 – Permissive List of Allowed Inputs

View all
CVE-2026-42043 CRITICAL POC
10.0
CVE-2026-29514 HIGH POC
8.7
CVE-2026-67345 HIGH POC
8.5
CVE-2024-38522 MEDIUM POC
6.3
CVE-2026-3490 CRITICAL POC
10.0
CVE-2026-66005 MEDIUM POC
5.3
CVE-2026-50189 HIGH
8.9
CVE-2026-46391 HIGH
8.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

Share

CVE-2026-63649 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy