Access Server: CVE-2026-98432 Linux Kernel Multipath

Impact on Access Server: Negligible.

Description

The vulnerability affects the core Linux kernel code that handles IPv4 TCP options. Although the publicly reported remote-root exploit chain demonstrated by Anthropic specifically targets services using Multipath TCP (MPTCP) listeners, the underlying vulnerability isn't limited to MPTCP.

Standard OpenVPN Access Server deployments, including the web interface, OpenVPN daemons, and SSH, use traditional single-path TCP sockets and don't expose MPTCP listeners. However, the underlying Linux kernel may still be vulnerable, so applying the appropriate kernel security update is recommended.

Remediation

When a fix becomes available for your Linux distribution, install the updated kernel using the standard package management commands (yum update for RHEL-based distros or apt update followed by apt upgrade for Ubuntu/Debian-based distros). Reboot the system to load the updated kernel.

Need Help?

If you have questions, submit a support ticket.