Access Server: CVE-2026-84256 remote command execution

Impact on Access Server: None.

Details:

OpenVPN Access Server uses OpenVPN for VPN connections. OpenVPN versions 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 are vulnerable to remote command execution on Windows clients.

On Windows, an authenticated remote user or peer can exploit a crafted X.509 certificate subject or other metadata containing shell metacharacters to execute arbitrary commands through .bat or .cmd script hooks with the privileges of the running OpenVPN process.

Access Server isn't affected by this vulnerability, which affects only OpenVPN clients running on Windows. Access Server doesn't use the affected OpenVPN options, can't be exploited on the server side, and doesn't generate malicious certificates.

Remediation:

To ensure Windows clients cannot be exploited by other servers or peers, we recommend updating affected OpenVPN client software to version 2.6.23 or later in the 2.6 release series, or version 2.7.8 or later in the 2.7 release series. Access Server and OpenVPN Connect aren't affected.

Need Help?

If you have questions, submit a support ticket.