{"id":"CVE-2026-84790","title":"OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field","summary":"OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field","severity":"high","cwe":["CWE-158","CWE-290"],"published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T22:18:58.937","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84790","references":[{"url":"https://community.openvpn.net/Security%20Announcements/CVE-2026-84790","label":"security@openvpn.net"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-13T23:03:54.751Z","vendor":"OpenVPN","product":"OpenVPN","affected":["OpenVPN >= 2.7_alpha1 <= 2.7.7"],"cvss":7.6,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","epss":0.00146,"epssPercentile":0.03817,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-18T13:38:57.486997Z"},"slug":"CVE-2026-84790","body":"## Overview\n\nOpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":221174,"id":"CVE-2026-84790","ts":1792030795012,"field":"cvss","old":null,"new":"7.6"},{"seq":221173,"id":"CVE-2026-84790","ts":1792030795012,"field":"severity","old":"none","new":"high"}]}