RCE in Openvpn
CVE-2026-84256
An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject
Vulnerability class: Command Injection (OS Command Injection)
Affected products
Weakness classification (CWE)
References
- security@openvpn.net (vendor-advisory)