How severe is CVE-2026-84790?

CVE-2026-84790 has a CVSS 4.0 base score of 7.6, rated high severity.

Is CVE-2026-84790 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-84790?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-84790 published?

CVE-2026-84790 was published on 2026-10-13 and last updated on 2026-10-18.

CVE-2026-84790

CVE-2026-84790 is a high-severity vulnerability with a CVSS 4.0 base score of 7.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-158.

Key facts

Severity: High (CVSS 4.0 base score 7.6)
EPSS exploit prediction: 0% (12th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-158
Published: 2026-10-13
Last modified: 2026-10-18

Description

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

Frequently asked questions

What is CVE-2026-84790?: OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
How severe is CVE-2026-84790?: CVE-2026-84790 has a CVSS 4.0 base score of 7.6, rated high severity.
Is CVE-2026-84790 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-84790?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-84790 published?: CVE-2026-84790 was published on 2026-10-13 and last updated on 2026-10-18.

References

https://community.openvpn.net/Security%20Announcements/CVE-2026-84790

Other CWE-158 vulnerabilities

CVE-2025-47812 — Critical (CVSS 10.0): In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection…
CVE-2025-14388 — Critical (CVSS 9.8): The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all…
CVE-2025-55113 — Critical (CVSS 9.0): If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support…
CVE-2023-5719 — High (CVSS 8.8): The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for…
CVE-2009-1537 — High (CVSS 8.8): Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0…
CVE-2025-9648 — High (CVSS 8.7): A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial…

Browse all CWE-158 vulnerabilities →