CVE-2026-81738

No known exploitation. EPSS puts it in the 27th percentile. No fix published yet.

CVSS —Not scored EPSS percentile27th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-09-07Updated 2026-09-08Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

OpenVPNAffected: ≥ 2.5.0, ≤ 2.7.6Upgrade to: after 2.7.6Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your organization's Windows machines run OpenVPN client version 2.5.0 through 2.7.6 with the tap-windows6 driver.
Confirm who controls the OpenVPN server(s) your staff connect to — only trust servers you fully control or trust.
Ask your VPN provider or IT team if a patched OpenVPN release or updated tap-windows6 driver is available, since no official fix exists yet.
Until a fix ships, avoid connecting Windows devices to untrusted or third-party OpenVPN servers.
Subscribe to OpenVPN's advisories so you can update as soon as a patched version is released.

May need vendor or contractor work

What it is

From the CVE record

OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries

In plain language

Written by AI from the record

A bug in the Windows version of OpenVPN (versions 2.5.0 through 2.7.6) lets a malicious or compromised VPN server corrupt your computer's network driver just by sending it a crafted setting — there's no fix available yet, so Windows VPN users should treat this as a real risk.

Out-of-bounds write (CWE-121/193/787) in the tap-windows6 kernel driver's parsing of OpenVPN DOMAIN-SEARCH push options allows a malicious/compromised OpenVPN server to corrupt kernel memory on connecting Windows clients, with potential for crash or code execution in driver context.

If you're affected

Windows endpoint compromise
System crashes/downtime
Potential full device takeover
Remote attacker foothold via VPN

What is it

Think of your VPN software like a mail carrier that delivers network settings from a server to your computer. This flaw means a dishonest or hacked 'mail carrier' can send a specially broken address label that confuses the delivery system badly enough to crash it or let the sender sneak in further. It only affects people using OpenVPN's Windows app with a particular driver.

Who is affected

This matters to you if your business uses OpenVPN's Windows client (versions 2.5.0 through 2.7.6) with the tap-windows6 driver to connect employees to a VPN. It's a risk any time your Windows devices connect to an OpenVPN server that isn't fully trusted or could be compromised, since the dangerous settings are delivered automatically as part of a normal connection — no special trickery needed from the user once connected.

How urgent is it

This is a serious, actively tracked memory-corruption flaw with no official patch available yet, and it's reachable through normal VPN connection behavior without any extra user action — that combination is why it's flagged red. There's no confirmed in-the-wild exploitation or public exploit code right now, but press attention on it is rising, and the absence of a fix means organizations should restrict exposure immediately rather than wait.

What to do — in detail

Confirm exposure by inventorying Windows hosts running OpenVPN client 2.5.0–2.7.6 with the tap-windows6 driver (check OpenVPN's version info and installed driver in Device Manager). No fixed version has been published yet per available patch data, so there is no upgrade target to point to today — monitor OpenVPN's official security advisories and GitHub releases for a patched 2.7.x or later build. As a temporary workaround, restrict client connections to only trusted, organization-controlled OpenVPN servers, disable or avoid use of the tap-windows6 driver in favor of the newer ovpn-dco/wintun driver where supported, and consider network segmentation or endpoint monitoring for crash/BSOD events on VPN-connected Windows machines. No CISA KEV due date applies since this CVE is not currently listed in KEV. Monitor vendor advisories, Windows Event Logs for driver crashes, and any emerging public exploit code for this CVE.

Technical context

Weakness: out-of-bounds write (CWE-787) via improper buffer size handling (CWE-131/193-family) when the tap-windows6 driver parses DOMAIN-SEARCH push options from a server; attack vector is network-adjacent via a malicious/compromised OpenVPN peer, reachable in default configuration with no special preconditions beyond being a Windows client of the affected version range. Exploit maturity is low — no public PoC and no confirmed exploitation in KEV or dated press reporting; EPSS scoring places predicted near-term exploitation likelihood in the low range with a flat trend. No patch is currently published, so this remains an open, unmitigated kernel-driver vulnerability. Press/pulse attention is rising (roundup coverage referencing threat actor ShinyHunters), but that reflects visibility, not confirmed in-the-wild use.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS27th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 27th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 1 day, from the signal feeds we watch.

2026-09-08Record updatedrecord updated
2026-09-07Publishedweakness classified, att&ck mapped, record updated

Affected products

OpenVPNoss-project · USaka connect, openvpn access server
- OpenVPNSecurity ProductOn-premNetworking Infrastructure

Technical detail

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Initial AccessT1190Exploit Public-Facing Applicationhigh confidence
Privilege EscalationT1068Exploitation for Privilege Escalationhigh confidence

Sources

References in the record

community.openvpn.net/Security%20Announcements/CVE-2026-81738

In the news

⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · 2026-10-05

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for OpenVPN, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account