Access Server: CVE-2026-121720 in OpenVPN

CVE record: CVE-2026-121720

Impact on Access Server: None.

Details

OpenVPN Access Server uses OpenVPN for VPN connections. OpenVPN versions 2.4.0 through 2.6.23 and 2.7_alpha1 through 2.7.8 on Windows contain a vulnerability that allows authenticated local users to execute arbitrary code through a privileged service using user-controlled environment variables. This vulnerability was fixed in OpenVPN 2.7.9.

This vulnerability affects Windows clients only. It can't be exploited on Access Server or triggered remotely on a client. OpenVPN Connect uses the OpenVPN3 core and isn't affected by this vulnerability. Therefore, only OpenVPN2 Windows clients running the affected versions are vulnerable.

Remediation

Update affected OpenVPN 2 Windows clients.

Need help?

If you have questions, submit a support ticket.