Description
The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths
Published: 2026-09-07
Score: 5.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Openvpn
Openvpn openvpn
Vendors & Products Openvpn
Openvpn openvpn

Mon, 07 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Title Local Authenticated Users Can Load Arbitrary Configuration Files in OpenVPN

Mon, 07 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 5.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'}

Subscriptions

Openvpn Openvpn
cve-icon MITRE

Status: PUBLISHED

Assigner: OpenVPN

Published:

Updated: 2026-09-07T07:21:20.770Z

Reserved: 2026-08-26T14:41:20.463Z

Link: CVE-2026-78043

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T08:17:12.637

Modified: 2026-09-07T08:17:12.637

Link: CVE-2026-78043

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T13:17:47Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')