CVE-2026-84226
Received Received - Intake

OpenVPN Windows Local Privilege Escalation via Binary Planting

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: OpenVPN Inc.

Description
OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-84226
EUVD
EUVD-2026-72283

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openvpn openvpn From 2.5.0 (inc) to 2.6.22 (inc)
openvpn openvpn From 2.7_alpha1 (inc) to 2.7.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-426 The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenVPN versions 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows. It allows local authenticated users to perform a binary planting attack during network configuration steps.

Detection Guidance

This vulnerability affects OpenVPN versions 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows. To detect it, check the installed OpenVPN version using 'openvpn --version' or inspect the program files for version details. If the version falls within the affected range, the system is vulnerable.

Impact Analysis

An attacker with local access and authentication could exploit this to execute arbitrary code or escalate privileges on the affected system. This could lead to unauthorized access, data theft, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected OpenVPN versions may face legal and regulatory penalties.

Mitigation Strategies

Upgrade OpenVPN to a version later than 2.6.22 or 2.7.6 on Windows systems to address the binary planting vulnerability during network configuration steps.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84226. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart