EUVD-2026-72280
GHSA-j6h9-44fx-3m85
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector; AC:H for iservice-absent precondition; PR:L for low-privileged account; scope change because other users' processes are disrupted; no confidentiality or integrity impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
OpenVPN on Windows (versions 2.0.0-2.6.22 and 2.7_alpha1-2.7.6) creates the --service exit event and netsh.exe guard semaphore with a NULL Discretionary Access Control List, granting any local process unrestricted access to these named synchronization objects. A low-privileged local user can acquire and hold the world-accessible semaphore indefinitely or signal the exit event, disrupting or terminating all other users' OpenVPN sessions on the same Windows host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged local account on the same Windows host as victim OpenVPN sessions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 1.8 (AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H) accurately reflects the narrow conditions under which exploitation is meaningful. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenVPN v2.7.7, which replaces the NULL DACL on the --service exit event and netsh.exe guard semaphore with properly restricted security descriptors, as documented at https://github.com/OpenVPN/openvpn/releases/tag/v2.7.7 and the security advisory at https://community.openvpn.net/Security%20Announcements/CVE-2026-82312. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker
Same weakness CWE-412 – Unrestricted Externally Accessible Lock
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today