CVE-2026-63649 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
OpenVPN	CNA	4.1 MEDIUM	LOCAL	LOW	LOW	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 23.35%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
openvpn	openvpn	2.4.0 ≤ 𝑥 < 2.6.22	CNA
openvpn	openvpn	𝑥 < 2.7.6	CNA

Ubuntu Releases

Ubuntu Product

Codename

openvpn

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	not-affected
trusty	not-affected
xenial	not-affected

Common Weakness Enumeration

CWE-183 - Permissive List of Allowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

References

https://community.openvpn.net/ReleaseHistory#openvpn-2622-released-5-august-2026

https://community.openvpn.net/ReleaseHistory#openvpn-276-released-5-august-2026

https://community.openvpn.net/Security%20Announcements/CVE-2026-63649