OpenVPN: Critical OpenVPN Connect for macOS Vulnerability Let Attackers Execute Arbitrary Commands

Critical Privilege Escalation Flaw Discovered in OpenVPN Connect for macOS

A critical vulnerability (CVE-2026-9560) has been identified in OpenVPN Connect for macOS, allowing local attackers to execute arbitrary commands with root privileges. The flaw, rated 9.4 (Critical) on the CVSS 4.0 scale, affects versions 3.5.1 through 3.8.1 and stems from an OS command injection weakness (CWE-78) in the application’s privileged helper component.

The vulnerability enables threat actors with local system access to exploit an Inter-Process Communication (IPC) channel, injecting malicious commands into OpenVPN’s background service without user interaction. Security researchers Ismael Esquilichi, Pablo Redondo, and Lê Đức Ninh were credited with the responsible disclosure. As of now, no public proof-of-concept exploits or active attacks have been reported.

OpenVPN addressed the flaw in a recent update, alongside two additional fixes: a browser authentication failure triggered by malformed server URLs and a UI bug causing crashes during blank profile imports.

Organizations using affected versions are advised to update immediately to mitigate potential lateral movement risks, particularly in shared macOS environments. Unpatched systems should be treated as high-risk endpoints.

Source: https://cybersecuritynews.com/openvpn-connect-for-macos-vulnerability/

OpenVPN TPRM report: https://www.rankiteo.com/company/openvpn

"id": "ope1779985422",
"linkid": "openvpn",
"type": "Vulnerability",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Cybersecurity/Networking',
                        'name': 'OpenVPN',
                        'type': 'Software Vendor'}],
 'attack_vector': 'Local',
 'description': 'A critical vulnerability (CVE-2026-9560) has been identified '
                'in OpenVPN Connect for macOS, allowing local attackers to '
                'execute arbitrary commands with root privileges. The flaw, '
                'rated 9.4 (Critical) on the CVSS 4.0 scale, affects versions '
                '3.5.1 through 3.8.1 and stems from an OS command injection '
                'weakness (CWE-78) in the application’s privileged helper '
                'component. The vulnerability enables threat actors with local '
                'system access to exploit an Inter-Process Communication (IPC) '
                'channel, injecting malicious commands into OpenVPN’s '
                'background service without user interaction. OpenVPN '
                'addressed the flaw in a recent update, alongside two '
                'additional fixes: a browser authentication failure triggered '
                'by malformed server URLs and a UI bug causing crashes during '
                'blank profile imports.',
 'impact': {'operational_impact': 'Potential lateral movement risks in shared '
                                  'macOS environments',
            'systems_affected': 'OpenVPN Connect for macOS (versions 3.5.1 '
                                'through 3.8.1)'},
 'post_incident_analysis': {'corrective_actions': 'Patch released to address '
                                                  'the vulnerability',
                            'root_causes': 'OS command injection weakness '
                                           '(CWE-78) in the application’s '
                                           'privileged helper component'},
 'recommendations': 'Organizations using affected versions are advised to '
                    'update immediately to mitigate potential lateral movement '
                    'risks. Unpatched systems should be treated as high-risk '
                    'endpoints.',
 'references': [{'source': 'Security Researchers (Ismael Esquilichi, Pablo '
                           'Redondo, Lê Đức Ninh)'}],
 'response': {'containment_measures': 'Update to patched versions',
              'remediation_measures': 'Released updates to fix the '
                                      'vulnerability (CVE-2026-9560) and two '
                                      'additional bugs'},
 'title': 'Critical Privilege Escalation Flaw Discovered in OpenVPN Connect '
          'for macOS',
 'type': 'Privilege Escalation',
 'vulnerability_exploited': 'CVE-2026-9560 (OS Command Injection - CWE-78)'}