CVSS 4.0
4.1 mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:NCVE-2026-63649
Medium (4.1). EPSS 0.3% chance of exploitation in the next 30 days.
The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
- CWE
- CWE-183
- Published
- Modified
- Record from
- the NVD, synced