CVE-2026-84790: 
OpenVPN vulnerability analysis and mitigation

CVE-2026-84790 is a certificate-handling weakness in OpenVPN affecting OpenSSL-based builds, where certificates whose subject fields contain embedded NULL bytes were not properly rejected during validation. The vulnerability is addressed in OpenVPN 2.7.8, which enforces stricter certificate subject field validation. The CVE status is currently listed as "Reserved" with limited official details published. The estimated severity is Medium based on Feedly threat intelligence data (Feedly).

The root cause of this vulnerability is insufficient validation of X.509 certificate subject fields, specifically the failure to reject certificates containing embedded NULL bytes (a classic NULL byte injection pattern, related to CWE-295: Improper Certificate Validation). Embedded NULL bytes in certificate subject fields can be exploited to spoof certificate identity, as string-handling functions may truncate at the NULL byte, causing a mismatch between the displayed and validated subject. This weakness is specific to OpenSSL-based builds of OpenVPN. The fix in OpenVPN 2.7.8 adds explicit rejection of such malformed certificates during the TLS handshake (Feedly, Linuxiac).

Successful exploitation of this vulnerability could allow an attacker with a specially crafted certificate — containing embedded NULL bytes in the subject field — to potentially bypass certificate validation checks in OpenVPN, enabling man-in-the-middle attacks or unauthorized VPN access. The confidentiality and integrity of VPN-protected communications could be compromised if an attacker can impersonate a legitimate certificate authority or endpoint. The impact is limited to OpenSSL-based OpenVPN deployments and does not affect configurations using other TLS backends (Feedly, Linuxiac).

As of the available data, there are no known public proof-of-concept exploits, exploit kits, or confirmed in-the-wild exploitation of CVE-2026-84790. The CVE remains in "Reserved" status with no EPSS score or CISA KEV catalog entry identified. Exploitation would require an attacker to obtain or forge a certificate with embedded NULL bytes in the subject field and position themselves to present it during a TLS handshake with a vulnerable OpenVPN instance (Feedly).

The primary remediation is to upgrade to OpenVPN 2.7.8 or later, which rejects certificates with embedded NULL bytes in subject fields for OpenSSL-based builds (Linuxiac, LinuxCompatible). Administrators should also audit their PKI infrastructure to ensure no certificates with NULL bytes in subject fields are in use. As a general hardening measure, restrict certificate issuance to trusted CAs and enforce strict certificate validation policies in OpenVPN configuration.

Coverage of OpenVPN 2.7.8's release highlighted the certificate and Windows security fixes as notable security hardening improvements. Linux-focused outlets such as Linuxiac and LinuxCompatible reported on the release, framing it as a security hardening update for certificates, TLS, and the kernel data channel. No significant controversy or researcher commentary beyond standard release coverage has been identified (Linuxiac, LinuxCompatible).