CVE-2026-63649

EUVD-2026-58812
The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
OpenVPNCNA
4.1 MEDIUM
LOCAL
LOW
LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 25.78%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openvpnopenvpn
2.4.0 ≤
𝑥
< 2.6.22
CNA
openvpnopenvpn
𝑥
< 2.7.6
CNA
Common Weakness Enumeration
References
https://community.openvpn.net/ReleaseHistory#openvpn-2622-released-5-august-2026
https://community.openvpn.net/ReleaseHistory#openvpn-276-released-5-august-2026
https://community.openvpn.net/Security%20Announcements/CVE-2026-63649