# OpenVPN vulnerabilities Source: https://junglewise.ai/threats/technologies/openvpn Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/openvpn.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in OpenVPN: 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-84471, was published on 14 October 2026. 3 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 11 - All time: 22 (0 critical, 0 exploited in the wild) ## About OpenVPN OpenVPN is open-source software that implements virtual private network protocols for secure remote access and site-to-site connectivity. ## Latest OpenVPN vulnerabilities - [CVE-2026-84471: OpenVPN use-after-free in TLS session promotion or expiry](https://junglewise.ai/threats/cve-2026-84471-the-fix-for-was-incomplete-a-use-after-free-in-openvpn-2-6-0) (info, published 14 Oct 2026) - [CVE-2026-88964: OpenVPN integer underflow in domain search options](https://junglewise.ai/threats/cve-2026-88964-an-integer-underflow-in-openvpn-version-2-7-alpha3-through-2-7-7) (info, published 13 Oct 2026) - [CVE-2026-84790: OpenVPN identity impersonation via embedded NUL in certificate subject](https://junglewise.ai/threats/cve-2026-84790-openvpn-2-7-alpha1-through-2-7-7-allows-remote-authenticated) (info, published 13 Oct 2026) - [CVE-2026-84732: OpenVPN ACK packet retransmission denial of service](https://junglewise.ai/threats/cve-2026-84732-openvpn-ack-packet-retransmission-denial-of-service) (info, published 7 Sep 2026) - [CVE-2026-84256: OpenVPN argument parsing vulnerability on Windows](https://junglewise.ai/threats/cve-2026-84256-openvpn-argument-parsing-vulnerability-on-windows) (info, CVSS 0, published 7 Sep 2026) - [CVE-2026-84226: OpenVPN binary planting on Windows](https://junglewise.ai/threats/cve-2026-84226-openvpn-binary-planting-on-windows) (info, published 7 Sep 2026) - [CVE-2026-82312: OpenVPN denial of service via NULL DACL on Windows IPC](https://junglewise.ai/threats/cve-2026-82312-openvpn-denial-of-service-via-null-dacl-on-windows-ipc) (info, published 7 Sep 2026) - [CVE-2026-81830: OpenVPN Windows interactive service path validation bypass](https://junglewise.ai/threats/cve-2026-81830-openvpn-windows-interactive-service-path-validation-bypass) (info, published 7 Sep 2026) - [CVE-2026-81738: OpenVPN out-of-bounds write in tap-windows6 driver](https://junglewise.ai/threats/cve-2026-81738-openvpn-out-of-bounds-write-in-tap-windows6-driver) (info, published 7 Sep 2026) - [CVE-2026-78221: OpenVPN Windows Interactive Service buffer size miscalculation](https://junglewise.ai/threats/cve-2026-78221-openvpn-windows-interactive-service-buffer-size-miscalculation) (info, published 7 Sep 2026) - [CVE-2026-78043: OpenVPN Windows Interactive Service configuration bypass](https://junglewise.ai/threats/cve-2026-78043-openvpn-windows-interactive-service-configuration-bypass) (info, published 7 Sep 2026) - [CVE-2026-63650: OpenVPN authentication identity lookup bypass in mbedTLS](https://junglewise.ai/threats/cve-2026-63650-openvpn-authentication-identity-lookup-bypass-in-mbedtls) (info, published 14 Aug 2026) - [CVE-2026-63649: OpenVPN Windows interactive service configuration bypass](https://junglewise.ai/threats/cve-2026-63649-openvpn-windows-interactive-service-configuration-bypass) (info, published 14 Aug 2026) - [CVE-2026-13379: OpenVPN Windows interactive service DNS pollution and denial of service](https://junglewise.ai/threats/cve-2026-13379-openvpn-windows-interactive-service-dns-pollution-and-denial-of) (info, CVSS 5.1, published 30 Jul 2026) - [CVE-2026-13117: OpenVPN use-after-free during TLS session promotion](https://junglewise.ai/threats/cve-2026-13117-openvpn-use-after-free-during-tls-session-promotion) (info, CVSS 6, published 30 Jul 2026) - [CVE-2026-12996: OpenVPN use-after-free in TLS session handling](https://junglewise.ai/threats/cve-2026-12996-openvpn-use-after-free-in-tls-session-handling) (info, CVSS 6, published 30 Jul 2026) - [CVE-2026-12932: OpenVPN memory leak in tls-crypt-v2 client key extraction](https://junglewise.ai/threats/cve-2026-12932-openvpn-memory-leak-in-tls-crypt-v2-client-key-extraction) (info, CVSS 7.1, published 30 Jul 2026) - [CVE-2026-11771: OpenVPN off-by-one buffer write in NTLM proxy authentication](https://junglewise.ai/threats/cve-2026-11771-openvpn-off-by-one-buffer-write-in-ntlm-proxy-authentication) (info, CVSS 7, published 30 Jul 2026) - [CVE-2026-13122: OpenVPN reachable assertion denial of service in external-auth](https://junglewise.ai/threats/cve-2026-13122-openvpn-reachable-assertion-denial-of-service-in-external-auth) (info, CVSS 5.9, published 6 Jul 2026) - [CVE-2026-13698: OpenVPN memory leak in tls-crypt-v2 handling](https://junglewise.ai/threats/cve-2026-13698-openvpn-memory-leak-in-tls-crypt-v2-handling) (info, CVSS 6, published 6 Jul 2026) - [CVE-2026-40215: OpenVPN race condition and use-after-free in TLS session promotion](https://junglewise.ai/threats/cve-2026-40215-openvpn-race-condition-and-use-after-free-in-tls-session) (info, CVSS 6.1, published 8 Jun 2026) - [CVE-2026-35058: OpenVPN denial of service via reachable assertion in tls-crypt-v2](https://junglewise.ai/threats/cve-2026-35058-openvpn-denial-of-service-via-reachable-assertion-in-tls-crypt-v2) (info, CVSS 6.9, published 8 Jun 2026) ## Most severe OpenVPN vulnerabilities - [CVE-2026-12932: OpenVPN memory leak in tls-crypt-v2 client key extraction](https://junglewise.ai/threats/cve-2026-12932-openvpn-memory-leak-in-tls-crypt-v2-client-key-extraction) (info, CVSS 7.1, published 30 Jul 2026) - [CVE-2026-11771: OpenVPN off-by-one buffer write in NTLM proxy authentication](https://junglewise.ai/threats/cve-2026-11771-openvpn-off-by-one-buffer-write-in-ntlm-proxy-authentication) (info, CVSS 7, published 30 Jul 2026) - [CVE-2026-35058: OpenVPN denial of service via reachable assertion in tls-crypt-v2](https://junglewise.ai/threats/cve-2026-35058-openvpn-denial-of-service-via-reachable-assertion-in-tls-crypt-v2) (info, CVSS 6.9, published 8 Jun 2026) - [CVE-2026-40215: OpenVPN race condition and use-after-free in TLS session promotion](https://junglewise.ai/threats/cve-2026-40215-openvpn-race-condition-and-use-after-free-in-tls-session) (info, CVSS 6.1, published 8 Jun 2026) - [CVE-2026-13117: OpenVPN use-after-free during TLS session promotion](https://junglewise.ai/threats/cve-2026-13117-openvpn-use-after-free-during-tls-session-promotion) (info, CVSS 6, published 30 Jul 2026) - [CVE-2026-12996: OpenVPN use-after-free in TLS session handling](https://junglewise.ai/threats/cve-2026-12996-openvpn-use-after-free-in-tls-session-handling) (info, CVSS 6, published 30 Jul 2026) - [CVE-2026-13698: OpenVPN memory leak in tls-crypt-v2 handling](https://junglewise.ai/threats/cve-2026-13698-openvpn-memory-leak-in-tls-crypt-v2-handling) (info, CVSS 6, published 6 Jul 2026) - [CVE-2026-13122: OpenVPN reachable assertion denial of service in external-auth](https://junglewise.ai/threats/cve-2026-13122-openvpn-reachable-assertion-denial-of-service-in-external-auth) (info, CVSS 5.9, published 6 Jul 2026) - [CVE-2026-13379: OpenVPN Windows interactive service DNS pollution and denial of service](https://junglewise.ai/threats/cve-2026-13379-openvpn-windows-interactive-service-dns-pollution-and-denial-of) (info, CVSS 5.1, published 30 Jul 2026) - [CVE-2026-84256: OpenVPN argument parsing vulnerability on Windows](https://junglewise.ai/threats/cve-2026-84256-openvpn-argument-parsing-vulnerability-on-windows) (info, CVSS 0, published 7 Sep 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 8 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Openvpn technologies - [Openvpn Ovpn-Dco-Win](https://junglewise.ai/threats/technologies/ovpn-dco-win): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OpenVPN vulnerabilities", https://junglewise.ai/threats/technologies/openvpn, 13 November 2026.