openvpn security advisories
7 threat alerts tracking vulnerabilities and security advisories that affect openvpn products.
Vulnios monitors openvpn CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent openvpn security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2024-27903 — openvpn — openvpn
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged O
criticalCVE-2024-27903Critical Vulnerability: CVE-2025-12106 — openvpn — openvpn
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses
criticalCVE-2025-12106Critical Vulnerability: CVE-2026-13379 — openvpn — openvpn
The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnect
criticalCVE-2026-13379Critical Vulnerability: CVE-2023-46850 — openvpn, debian — openvpn, openvpn_access_server
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
criticalCVE-2023-46850Critical Vulnerability: CVE-2020-8953 — openvpn — openvpn_access_server
OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication).
criticalCVE-2020-8953Critical Vulnerability: CVE-2018-7544 — openvpn — openvpn
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connecte
criticalCVE-2018-7544Critical Vulnerability: CVE-2017-12166 — openvpn, debian — openvpn, debian_linux
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
criticalCVE-2017-12166
Track openvpn exposure across your environment
Vulnios automatically cross-references your asset inventory against new openvpn CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan