CVE-2026-84790
Fixed in a distro release EPSS <1%CVSS 7.6
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
Products: OpenVPN
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | openvpn | no fix |
| Debian:13 | openvpn | no fix |
| Debian:14 | openvpn | 2.7.8-1 |
| Ubuntu:20.04:LTS | openvpn | no fix |
| Ubuntu:22.04:LTS | openvpn | 2.5.11-0ubuntu0.22.04.6 |
| Ubuntu:24.04:LTS | openvpn | 2.6.19-0ubuntu0.24.04.5 |
| Ubuntu:26.04:LTS | openvpn | 2.7.0-1ubuntu1.4 |
| Ubuntu:26.10 | openvpn | 2.7.7-1ubuntu1.1 |
| Ubuntu:Pro:14.04:LTS | openvpn | no fix |
| Ubuntu:Pro:16.04:LTS | openvpn | no fix |
| Ubuntu:Pro:18.04:LTS | openvpn | no fix |