CVE-2026-84790

Awaiting Analysis Awaiting Analysis - Queue

OpenVPN Certificate Spoofing via Subject Field

Publication date: 2026-10-13

Last updated on: 2026-10-18

Assigner: OpenVPN Inc.

Description

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-84790

EUVD

EUVD-2026-100750

Affected Vendors & Products

Vendor	Product	Version / Range
OpenVPN	OpenVPN	2.7_alpha1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-158	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenVPN versions 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others by crafting a certificate subject field. This means an attacker with valid credentials could forge their identity in the system.

Impact Analysis

An attacker could gain unauthorized access to systems or data by impersonating legitimate users. This could lead to data breaches, unauthorized actions, or bypassing security controls.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, fines, or reputational damage.

Mitigation Strategies

Upgrade OpenVPN to a version beyond 2.7.7 to address the certificate subject field impersonation issue. Review and validate all user certificates to ensure no unauthorized subjects are present.

Hi! I’m here to help you understand CVE-2026-84790. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70