PatchTheCVEopenvpn vulnerabilities and fixes
Recent CVEs affecting openvpn, with upgrade or downgrade steps. 5 tracked.
openvpn has 5 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-07-30. Highest priority: CVE-2026-13379 (score 44/100).
- CVE-2026-11771 HIGH 7.5 UPGRADE OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer wr
- CVE-2026-12932 HIGH 8.1 UPGRADE A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through
- CVE-2026-12996 HIGH 8.1 UPGRADE MITIGATE A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peer
- CVE-2026-13117 HIGH 8.1 UPGRADE An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated p
- CVE-2026-13379 CRITICAL 9.1 UPGRADE The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persisten
FAQ
How do I fix openvpn vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is openvpn being exploited right now?
None of the tracked openvpn CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which openvpn CVE should I patch first?
CVE-2026-13379 currently ranks highest (44/100): The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persisten.