CVE-2026-84790 is a security vulnerability in OpenVPN, a virtual private network software package, affecting Ubuntu releases 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS. The flaw occurs because OpenVPN incorrectly handled certificate subject fields, allowing a remote authenticated user to possibly impersonate other users. The attack vector is remote, but the attacker must first possess valid authentication credentials or otherwise be an authenticated user within the OpenVPN environment. By exploiting improper handling of certificate subject information, the attacker can present or manipulate identity-related certificate data in a way that causes the system to associate the attacker with another user's identity. This can undermine the trust model of the VPN service, because users may believe they are communicating with or accessing resources as a different authenticated principal. The business impact includes unauthorized access to network services, potential compromise of confidential data, disruption of service availability, loss of auditability, and increased risk of lateral movement within protected networks. Organizations relying on OpenVPN for secure remote access may face operational, compliance, and reputational consequences if impersonation enables access to sensitive systems or violates access-control policies.
We recommend you to update OpenVPN to version 2.7.7-1ubuntu1.1, 2.7.0-1ubuntu1.4, 2.6.19-0ubuntu0.24.04.5, or 2.5.11-0ubuntu0.22.04.6 depending on your installed branch.[/subscribe_to_unlock_form]
CVE-2026-84790 is a security vulnerability in OpenVPN, a virtual private network software package, affecting Ubuntu releases 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS. The flaw occurs because OpenVPN incorrectly handled certificate subject fields, allowing a remote authenticated user to possibly impersonate other users. The attack vector is remote, but the attacker must first possess valid authentication credentials or otherwise be an authenticated user within the OpenVPN environment. By exploiting improper handling of certificate subject information, the attacker can present or manipulate identity-related certificate data in a way that causes the system to associate the attacker with another user's identity. This can undermine the trust model of the VPN service, because users may believe they are communicating with or accessing resources as a different authenticated principal. The business impact includes unauthorized access to network services, potential compromise of confidential data, disruption of service availability, loss of auditability, and increased risk of lateral movement within protected networks. Organizations relying on OpenVPN for secure remote access may face operational, compliance, and reputational consequences if impersonation enables access to sensitive systems or violates access-control policies.
We recommend you to update OpenVPN to version 2.7.7-1ubuntu1.1, 2.7.0-1ubuntu1.4, 2.6.19-0ubuntu0.24.04.5, or 2.5.11-0ubuntu0.22.04.6 depending on your installed branch.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]