Is CVE-2026-40215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40215 being exploited in the wild.

How severe is CVE-2026-40215?

Informational severity, with a CVSS score of 6.1, published 8 June 2026.

Which products and versions are affected?

OpenVPN Inc. OpenVPN 2.6.0 through 2.6.19, 2.7_alpha1 through 2.7.1.

Is there a fix for CVE-2026-40215?

A patch was published on 2026-04-22: OpenVPN 2.6.20 and 2.7.2 released to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40215 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40215?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40215: OpenVPN race condition and use-after-free in TLS session promotion

CVE-2026-40215 · Severity: info · CVSS 6.1 · Published 2026-06-08

OpenVPN, a widely used software for creating secure private networks, contains a vulnerability that could allow an attacker to crash the server or access sensitive memory. This issue occurs during the process of establishing a secure connection, potentially leading to service outages or the exposure of internal system data. Organizations using affected versions should update to OpenVPN 2.6.20 or 2.7.2 to maintain service availability and data confidentiality.

Quick answers

Is CVE-2026-40215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40215 being exploited in the wild.
How severe is CVE-2026-40215?: Informational severity, with a CVSS score of 6.1, published 8 June 2026.
Which products and versions are affected?: OpenVPN Inc. OpenVPN 2.6.0 through 2.6.19, 2.7_alpha1 through 2.7.1.
Is there a fix for CVE-2026-40215?: A patch was published on 2026-04-22: OpenVPN 2.6.20 and 2.7.2 released to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40215 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40215?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 during the TLS session promotion phase. This flaw can lead to a use-after-free (CWE-416) or an out-of-bounds read (CWE-125). A remote attacker with low privileges (PR:L) can exploit this over the network to trigger a denial-of-service (server crash) or leak sensitive information from the heap memory. The vulnerability is addressed in OpenVPN versions 2.6.20 and 2.7.2.

Affected products

OpenVPN Inc. OpenVPN 2.6.0 through 2.6.19, 2.7_alpha1 through 2.7.1

Timeline

2026-04-22: patched: OpenVPN 2.6.20 and 2.7.2 released to address the issue.
2026-06-08: disclosed: CVE-2026-40215 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.