Patch & vulnerability status
OpenVPN Inc.
OpenVPN Connect v2 2.7.6
Latest tracked version 2.7.6. Release status, tracked CVEs, and automated cross-platform patching for OpenVPN Connect v2.
| Platform | Latest version | CVEs tracked | Last checked |
|---|---|---|---|
| Windows | 2.7.6 | 9 | 2026-08-10 |
Known vulnerabilities (CVEs) in OpenVPN Connect v2
Lavawall tracks 9 published CVEs affecting OpenVPN Connect v2, and deploys the versions that fix them automatically across your fleet.
| CVE | Published | Severity | Details | Vector |
|---|---|---|---|---|
| LW-202503211 | 2025-03-21 03:10:20 | MEDIUM (7) | OpenVPN Connect prior to 3.6.0 did not automatically update | |
| CVE-2026-9560 | 2026-05-26 18:16:59 | CRITICAL (9) | Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel | LOCAL |
| CVE-2024-8474 | 2025-01-06 15:15:15 | HIGH (8) | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic | NETWORK |
| CVE-2023-7245 | 2024-02-20 11:15:08 | HIGH (8) | The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable | LOCAL |
| CVE-2023-7224 | 2024-01-08 14:15:47 | HIGH (8) | OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable | LOCAL |
| CVE-2022-3761 | 2023-10-17 13:15:12 | MEDIUM (6) | OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials | NETWORK |
| CVE-2021-3613 | 2021-07-02 13:15:08 | HIGH (8) | OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (OpenVPNConnect.exe). | LOCAL |
| CVE-2020-9442 | 2020-02-28 14:15:10 | HIGH (8) | OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there. | LOCAL |
| CVE-2020-15075 | 2021-03-30 14:15:13 | HIGH (7) | OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp. | LOCAL |
Why keeping OpenVPN Connect v2 patched matters
Unpatched third-party applications are one of the most common ways attackers get in: 57% of breached MSP clients and 32% of ransomware cases trace back to a missing patch. Every OpenVPN Connect v2 release that fixes a security bug is public, so attackers see it too, and an out-of-date install becomes a documented way in. Tracking the installed version on every machine and closing the gap quickly is what turns a disclosed CVE into a non-event.
How Lavawall® patches OpenVPN Connect v2
Lavawall® watches OpenVPN Connect v2 releases and CVEs continuously, ranks each update by risk, and deploys it across your whole fleet, Windows, macOS, and Linux, from a single agent, independently of your RMM. You get one place to see which machines are behind on OpenVPN Connect v2, one policy to bring them current, and timestamped evidence for audits.
Frequently asked questions
Lavawall tracks OpenVPN Connect v2 at version 2.7.6 (last checked 2026-08-10). New releases are monitored continuously and can be deployed automatically across your fleet.
Lavawall tracks 9 CVEs for OpenVPN Connect v2 and remediates them automatically as part of patching.
Deploy the Lavawall® agent and OpenVPN Connect v2 updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Lavawall® monitors releases and CVEs for OpenVPN Connect v2 through public information and proprietary statistical analysis, and can patch it automatically across your fleet.