PT-2026-43371 · Openvpn · Openvpn Connect

Ismael Esquilichi + 2 · Published 2026-05-26 · Updated 2026-06-15 · CVE-2026-9560

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions OpenVPN Connect versions 3.5.1 through 3.8.1

Description A privilege escalation issue exists in the background service of OpenVPN Connect on macOS. This allows attackers to execute arbitrary commands with elevated privileges by utilizing a local IPC (Inter-Process Communication) channel, which is a mechanism that allows different processes to communicate with each other on the same operating system.

Fix

LPE

OS Command Injection

Weakness Enumeration

CWE-648

CWE-267

CWE-78

CWE-270

Related Identifiers

CVE-2026-9560

Affected Products

Openvpn Connect

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2026-9560 · Security Note
• https://twitter.com/lyrie_ai/status/2063837459650081025 · Twitter Post
• https://twitter.com/ThreatAft/status/2060371710902485008 · Twitter Post
• https://twitter.com/lyrie_ai/status/2063837455397056817 · Twitter Post
• https://twitter.com/lyrie_ai/status/2063837458614092142 · Twitter Post
• https://twitter.com/lyrie_ai/status/2063837457485910112 · Twitter Post
• https://twitter.com/CVEnew/status/2059337159174234188 · Twitter Post
• https://t.me/CVEtracker/55006 · Telegram Post
• https://twitter.com/integ_sec/status/2066494697686671481 · Twitter Post
• https://twitter.com/dailytechonx/status/2060409337693004015 · Twitter Post
• https://twitter.com/lyrie_ai/status/2063837456454021364 · Twitter Post
• https://openvpn.net/connect-docs/macos-release-notes.html · Note
• https://twitter.com/UndercodeUpdate/status/2060352317082231012 · Twitter Post