CVE-2026-84226

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84226", "assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "state": "PUBLISHED", "assignerShortName": "OpenVPN", "dateReserved": "2026-09-01T11:57:34.684Z", "datePublished": "2026-09-07T07:47:04.345Z", "dateUpdated": "2026-09-08T14:59:53.551Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "shortName": "OpenVPN", "dateUpdated": "2026-09-07T07:47:04.345Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-426", "description": "CWE-426 Untrusted Search Path", "type": "CWE"}]}], "affected": [{"vendor": "OpenVPN", "product": "OpenVPN", "platforms": ["Windows"], "modules": ["tapctl"], "versions": [{"status": "affected", "version": "2.5.0", "lessThanOrEqual": "2.6.22", "versionType": "semver"}, {"status": "affected", "version": "2.7_alpha1", "lessThanOrEqual": "2.7.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps"}], "references": [{"tags": ["vendor-advisory"], "url": "https://community.openvpn.net/Security%20Announcements/CVE-2026-84226"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-08T14:59:44.196975Z", "id": "CVE-2026-84226", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T14:59:53.551Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-84226", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-08T14:59:44.196975Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T14:59:47.752Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenVPN", "modules": ["tapctl"], "product": "OpenVPN", "versions": [{"status": "affected", "version": "2.5.0", "versionType": "semver", "lessThanOrEqual": "2.6.22"}, {"status": "affected", "version": "2.7_alpha1", "versionType": "semver", "lessThanOrEqual": "2.7.6"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://community.openvpn.net/Security%20Announcements/CVE-2026-84226", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "CWE-426 Untrusted Search Path"}]}], "providerMetadata": {"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "shortName": "OpenVPN", "dateUpdated": "2026-09-07T07:47:04.345Z"}}}, "cveMetadata": {"cveId": "CVE-2026-84226", "state": "PUBLISHED", "dateUpdated": "2026-09-08T14:59:53.551Z", "dateReserved": "2026-09-01T11:57:34.684Z", "assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "datePublished": "2026-09-07T07:47:04.345Z", "assignerShortName": "OpenVPN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["tapctl"], "platforms": ["Windows"], "product": "OpenVPN", "vendor": "OpenVPN", "versions": [{"lessThanOrEqual": "2.6.22", "status": "affected", "version": "2.5.0", "versionType": "semver"}, {"lessThanOrEqual": "2.7.6", "status": "affected", "version": "2.7_alpha1", "versionType": "semver"}]}], "source": "security@openvpn.net"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps"}], "id": "CVE-2026-84226", "lastModified": "2026-09-08T19:07:52.113", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@openvpn.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-84226", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-08T14:59:44.196975Z", "version": "2.0.3"}}]}, "published": "2026-09-07T08:17:13.653", "references": [{"source": "security@openvpn.net", "url": "https://community.openvpn.net/Security%20Announcements/CVE-2026-84226"}], "sourceIdentifier": "security@openvpn.net", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "security@openvpn.net", "type": "Secondary"}]}

{"bugzilla": {"description": "OpenVPN: OpenVPN: Arbitrary Code Execution via Binary Planting on Windows", "id": "2529304", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529304"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-426", "details": ["A flaw was found in OpenVPN on Windows. A local authenticated user could perform a binary planting attack during network configuration steps. This vulnerability could allow the attacker to execute arbitrary code or escalate privileges on the affected system."], "name": "CVE-2026-84226", "public_date": "2026-09-07T07:47:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84226\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84226\nhttps://community.openvpn.net/Security%20Announcements/CVE-2026-84226"], "statement": "The vulnerability is rated as Important because it allows local authenticated users to achieve arbitrary code execution via a binary planting attack during network configuration steps. However, this flaw specifically affects OpenVPN on Windows platforms. Red Hat's OpenVPN packages, available in Community Projects like Fedora and EPEL, are built for Linux environments and are not susceptible to this Windows-specific vulnerability.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[2.5.0,2.6.22]"}}, {"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[2.7_alpha1,2.7.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenVPN", "source": "cna", "vendor": "OpenVPN"}, "product": "openvpn", "vendor": "openvpn"}], "created": "2026-09-07T14:00:17.399572+00:00", "title": "OpenVPN Windows Binary Planting vulnerability allows local code execution during configuration", "updated": "2026-09-07T14:30:17.451626+00:00", "vendors": ["openvpn", "openvpn$PRODUCT$openvpn"]}