CVE-2026-9560: openvpn inc openvpn connect OS Command Injection
CVSS: 9.4v4.0CriticalAnalyzed
Published 26-05-2026Last modified 27-05-2026
Vulnerability summary
CVE-2026-9560 is a critical (CVSS 9.4) OS Command Injection vulnerability in openvpn inc openvpn connect. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.1% of scored vulnerabilities.
CVSS score
9.4/10
010
Critical · v4.0 (CVE.org)EPSS score
0.38%
0%100%
Low · -0.20 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 26-05-2026PublishedVulnerability first disclosed.
- 27-05-2026Last modifiedVulnerability information updated.
Description
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel
CVSS metrics
3 scores · 2 sources · 2 versionsCritical 9.4Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HSourcesAll 2 agree
- NVDNIST9.4CriticalCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
-0.20 pp
From 0.57% on 20-09-2026
20-09-202620-10-2026
EPSS score0.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
- CWE-267Privilege Defined With Unsafe ActionsA particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
- CWE-270Privilege Context Switching ErrorThe product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
- CWE-648Incorrect Use of Privileged APIsThe product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
Affected systems
Openvpn1 product
- connect≥ 3.5.1, < 3.8.2
Openvpn inc1 product
- openvpn connect≥ 3.5.1, ≤ 3.8.1
2 vendors · 2 products
References
1 links- openvpn.net/connect-docs/macos-release-notes.htmlRelease Notes