CVE-2026-9560
A local privilege‑escalation flaw exists in OpenVPN Connect 3.5.1 through 3.8.1 on macOS. The background service can be abused via a local IPC channel to run arbitrary commands with elevated privileges. The vulnerability is only exploitable on macOS and requires local access.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running OpenVPN Connect 3.5.1 to 3.8.1 on macOS, including corporate VPN clients and home users.
Real-world impact
An attacker who can log into the macOS machine can execute any command as a privileged user, potentially taking full control of the system, installing malware, or exfiltrating data.
Why this severity
The CVSS score of 9.4 reflects that the flaw allows local attackers to gain high‑level privileges without authentication, with a high impact on confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 26, 2026 · May 26, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- openvpn.net/connect-docs/macos-release-…release notes