CVE-2026-82312

No known exploitation. EPSS puts it in the 1st percentile. No fix published yet.

CVSS —Not scored EPSS percentile1st0.1% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-09-07Updated 2026-09-08Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

OpenVPNAffected: ≥ 2.0.0, ≤ 2.6.22Upgrade to: after 2.6.22Affected: ≥ 2.7_alpha1, ≤ 2.7.6Upgrade to: after 2.7.6Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check if you run OpenVPN on Windows machines, especially shared or multi-user computers, and confirm the version is between 2.0.0 and 2.6.22, or 2.7_alpha1 and 2.7.6.
Restrict who can log into any Windows machine running OpenVPN — treat untrusted local accounts as a real risk until this is fixed.
Watch the official OpenVPN release notes closely, since no fixed version has been published yet.
Once a patched release is available, upgrade all affected Windows installations immediately and restart the OpenVPN service.

May need vendor or contractor work

What it is

From the CVE record

OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects

In plain language

Written by AI from the record

A flaw in OpenVPN for Windows lets another person already logged into the same computer crash the VPN connection for everyone using it, and there's no fix available yet.

CVE-2026-82312 is a local denial-of-service in OpenVPN 2.0.0–2.6.22 and 2.7_alpha1–2.7.6 on Windows, caused by a NULL DACL (CWE-732/CWE-412) on named IPC objects that lets any authenticated local user disrupt the service by interacting with those objects.

If you're affected

VPN service disruption
Remote workforce connectivity loss
Operational disruption
Shared-computer sabotage risk

What is it

Think of OpenVPN's internal communication files on Windows like an unlocked internal office door that's supposed to only open for certain staff — because the lock settings are missing, any employee with building access can walk in and knock the system offline. It doesn't let anyone steal data, but it can stop your VPN from working for everyone relying on it.

Who is affected

This matters to you if you run OpenVPN on Windows machines — especially shared computers, terminal servers, or any system where more than one person has a local login. It is not a remote internet attack; it only matters if an untrusted or lower-privileged person already has an account on that same Windows machine.

How urgent is it

There is no evidence yet of attackers actively exploiting this, and no public exploit code exists, but press attention around it is rising and no vendor fix has been released for any affected version. Because the flaw spans nearly every current OpenVPN Windows release and remains unpatched, treat this as a pressing issue to track and mitigate now rather than wait.

What to do — in detail

Confirm exposure by inventorying all Windows hosts running OpenVPN and checking version numbers against the affected ranges (2.0.0–2.6.22 and 2.7_alpha1–2.7.6). There is currently no fixed version published by the vendor — monitor OpenVPN's official advisories and GitHub releases for a patch addressing the NULL DACL on named IPC objects. As a temporary workaround, limit local login access on affected Windows hosts to trusted administrative accounts only, and consider isolating OpenVPN servers from shared multi-user environments until patched. There is no CISA KEV entry or due date for this CVE. Once a fix ships, prioritize upgrading internet-facing or shared-access OpenVPN Windows installations first, then verify the IPC object permissions are corrected. Monitor OpenVPN service logs for unexpected crashes or restarts as an indicator of attempted exploitation.

Technical context

Weakness: CWE-412 (Unrestricted Externally Accessible Lock) and CWE-732 (Incorrect Permission Assignment for Critical Resource) — a NULL discretionary access control list (DACL) on named IPC objects allows any authenticated local user to tamper with or crash them. Attack vector is local, requires authentication, no user interaction needed; impact is denial of service only. No public exploit code is known, no KEV listing exists, and EPSS scores this as very low predicted exploitation likelihood with a flat trend. No patch is currently available across any affected branch (2.0.0–2.6.22, 2.7_alpha1–2.7.6).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS1st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.1% chance of exploitation activity in the next 30 days, which ranks it in the 1st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 1 day, from the signal feeds we watch.

2026-09-08Record updatedrecord updated
2026-09-07Publishedweakness classified, att&ck mapped, record updated

Affected products

OpenVPNoss-project · USaka connect, openvpn access server
- OpenVPNSecurity ProductOn-premNetworking Infrastructure

Technical detail

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Privilege EscalationT1068Exploitation for Privilege Escalationmedium confidence

Sources

References in the record

community.openvpn.net/Security%20Announcements/CVE-2026-82312

In the news

⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · 2026-10-05

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for OpenVPN, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account