Loading story…
Microsoft disclosed four vulnerabilities in OpenVPN that can be chained to let an attacker gain full control of affected Windows systems, combining remote code execution, local privilege escalation, and service disruption. The issues affect OpenVPN versions earlier than 2.6.10 and were presented by Microsoft researchers at Black Hat USA 2024 after being patched by the OpenVPN project in March 2024.
The vulnerabilities are tracked as CVE-2024-27459, CVE-2024-24974, CVE-2024-27903, and CVE-2024-1305, and impact components including openvpn.exe, openvpnserv.exe, and the tap-windows6 driver. Microsoft and CSIRT.SK said a remote attacker could chain the flaws to achieve full system compromise, prompting administrators and users to upgrade OpenVPN to 2.6.10 or later.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
OpenVPN developers patched four vulnerabilities affecting versions earlier than 2.6.10 by releasing OpenVPN 2.6.10 in March 2024. The flaws included CVE-2024-27459, CVE-2024-24974, CVE-2024-27903, and CVE-2024-1305.
Microsoft security researchers disclosed four OpenVPN vulnerabilities at Black Hat USA 2024, describing how they could be chained by a remote attacker to gain full control of a system. The issues could enable remote code execution, local privilege escalation, and service disruption in affected OpenVPN components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenVPN released version **2.7.7** to remediate seven vulnerabilities in its cross-platform reliability layer and Windows-specific components. The most broadly exposed issue, **CVE-2026-84732**, affects OpenVPN through versions 2.6.22 and 2.7.6: a remote unauthenticated attacker can send crafted ACK packet-ID retransmissions that cause a TLS reliability-layer timeout integer overflow and disrupt VPN service on Linux, macOS, and Windows. Six additional flaws affect Windows deployments, including command-line quoting weaknesses, restricted configuration-path validation bypass, potential `netsh.exe` path abuse, permissive object ACLs enabling local cross-user denial of service, a buffer overread, and a one-byte buffer overflow. The update also adds Linux netlink-reply validation alongside networking, resource-use, and key-management improvements; organizations should prioritize upgrading OpenVPN clients and servers to 2.7.7.
Sep 12, 2026
Microsoft published security advisories for several remote code execution vulnerabilities affecting core Windows networking and productivity components, including **Layer 2 Tunneling Protocol (L2TP)** flaws tracked as `CVE-2023-41765`, `CVE-2023-41770`, and `CVE-2023-41773`, a **Windows Remote Desktop Services** issue tracked as `CVE-2025-21297`, and a **Microsoft Office** vulnerability tracked as `CVE-2026-40358`. The advisories indicate that the affected attack surfaces span remote access, tunneling, and document-handling functionality, increasing the importance of patching internet-exposed and user-facing systems.
Jul 12, 2026
Microsoft released security updates for two **Windows Point-to-Point Tunneling Protocol (PPTP)** remote code execution vulnerabilities, tracked as **`CVE-2022-41039`** and **`CVE-2022-41088`**. Both issues affect the Windows implementation of PPTP, a legacy VPN tunneling protocol, and were published through Microsoft's Security Update Guide as separate advisories. The paired disclosures indicate that attackers could potentially exploit weaknesses in the PPTP component to execute code on affected Windows systems, making patching a priority for organizations that still expose or rely on PPTP services. Security teams should identify systems with PPTP enabled, apply Microsoft's fixes for both CVEs, and review whether continued use of PPTP is necessary given its age and security history.
Jul 12, 2026