OpenVPN ships 2.6.23, a security-only patch closing seven vulnerabilities
The new release packs six CVEs plus one extra hardening fix, five of them are Windows-specific, and several appear to have been found with AI-assisted tooling.
OpenVPN 2.6.23 is out, and it's a security release through and through. The project published it today as the newest patch in the 2.6.x stable line. It seals seven distinct vulnerabilities, six with assigned CVE numbers, one more as plain hardening, and there's not a single feature change hidden among them.
That's a bit unusual for a point release. Most 2.6.x updates slip in a new option alongside the fixes. This one came together from 10 commits merged between August 31 and September 23, and every one of them maps to a security fix. Five of the seven flaws hit Windows, so it matters a lot if you run OpenVPN's service or TAP drivers on a Windows machine.
OpenVPN is the oldest surviving major VPN project and, by a lot of measures, the most widely deployed one. It started back in 2002 and has become a reference implementation that network architects lean on, which also makes it a standing target. The core stays open source under GPL-2.0, owned commercially by Fortinet, with Access Server and CloudConnexa as the paid products.
Keep in mind that these fixes were backported from the master branch, so existing 2.6.x users don't have to jump through a major-version upgrade just to stay safe.
Across all platforms
The reliability layer is how OpenVPN guarantees control packets actually get delivered. The first bug here, CVE-2026-84732 reported by Mark Bregman of Fox-IT, let a retransmit timeout grow without limit and, in a nasty case, overflow an integer. A peer could also ack packets that were never sent, destabilizing the send buffer. The fix caps the timeout and makes the ack comparison wraparound-safe. Availability issues, mostly, though overflow conditions in C tend to lead somewhere uglier.
Then there's the double-free during a "lame duck" shutdown (CVE-2026-84471). Andreas Gabriel Berbescu and Haruki Oyama at Waseda University found that a buffer-use check could be skipped during a graceful shutdown, opening a classic memory-corruption window. The fix moves that check straight into the freeing routine, which the commit candidly calls a "band-aid fix" while a larger refactor waits in the wings.
The sharpest cross-platform issue doesn't even carry its own CVE number. A peer can send a reset packet demanding the client resend a wrapped key — a flag the client set only because the peer said one existed, not because it actually does. For a client running without --tls-crypt-v2, that key isn't there at all, so the code sizes a buffer for a key that doesn't exist, dereferences NULL, and segfaults. And this happens before the peer is even authenticated. An unauthenticated attacker can force the crash at will, so upgrading closes it. That said, teams may also want to reconsider whether --tls-crypt-v2 fits their setup.
Windows gets the rough end of the stick
Five of the seven flaws are Windows-specific, and they touch the nastiest bug classes around: command injection, buffer overflows, binary planting.
The command-injection one, CVE-2026-84256, comes from how OpenVPN hands arguments to cmd.exe when it runs .bat and .cmd helper scripts. The wide_cmd_line() function only quoted arguments containing spaces, leaving shell metacharacters like &, |, and < exposed. A crafted value like a certificate subject fed to --tls-verify, could slip in a second command entirely. The reporters here read like a who's who of independent shops: Clouditera, Z.ai Security, and NSFOCUS. The fix quotes those extra delimiters, though commas and semicolons stay unquoted on purpose because cmd.exe uses them to split positional parameters.
The netsh bug, CVE-2026-84226, is worth a second look. When the TAP driver control needed to reconfigure the network stack, it called netsh.exe with a NULL application name, which makes Windows search the whole PATH for the executable. That's basically a license for binary planting: drop a malicious netsh.exe earlier in the path and OpenVPN runs it instead of the real one. The fix builds the full system path and passes it explicitly. And it was found with AI-assisted tooling, BreachX Zero Day Labs, using something they call "Typhon AI Mil v2," with contributor Vivek Parikh. That's becoming common enough that the commit lists the AI tool alongside the human credit. Not saying robots are about to take over security research, but these keeps turning up real, exploitable plumbing bugs that manual review tends to skip.
The NULL-DACL flaw, CVE-2026-82312, is a simpler story. Two Windows sync objects, the service exit event and a netsh guard semaphore, were created with a NULL DACL, meaning any user on a shared box could signal or jam them. Shut down a stranger's running instance, or time out their connections with ease. The fix hands each object to its creating user only, and it doesn't touch iservice-based deployments, so check which model you're on before assuming you're clear.
Then comes the DHCP off-by-one overflow, CVE-2026-81738. A server-supplied run of --dhcp-option entries could push exactly one byte past a 256-byte stack buffer. A single out-of-bounds write is rarely fatal on its own, but it's enough to corrupt adjacent stack data, and those entries come from the server with no length limit, so a malicious or compromised server is the likely vector. It was caught under AddressSanitizer, reproduced at dhcp.c:308.
The last Windows hole, CVE-2026-81830, is config-directory traversal. The service validated that a config lived inside the allowed directory by checking only the path prefix, so a sibling like config-evil would pass as config. The fix requires a path separator right after the config directory, so siblings can't masquerade as the real thing. It won't let you read files outside your own permissions, but it plugs a loophole that combines neatly with other flaws.
What you should do
Upgrade. The command injection, the overflows, the binary planting, these are all things that can get you code execution or a crash, and five of the seven are Windows-specific, so treat it as urgent if you're on Windows. OpenVPN Access Server, CloudConnexa, and any self-hosted 2.6.x deployment should move to 2.6.23 the moment it's feasible.
For deployments not using --tls-crypt-v2, the pre-auth crash is worth a specific look. Upgrading closes it, but it may also be a good moment to decide whether --tls-crypt-v2 suits your environment.
One more thing worth repeating: keep the host's PATH clean and don't run OpenVPN from untrusted directories. The fixes touch how the software calls netsh.exe and re-parses command lines, so the old "don't run privileged stuff from sketchy places" advice still holds.
Head here to grab the release on GitHub.
