Is OpenVPN 2.3.18 affected?

Sep 25, 2017 · Release notes ↗

CVSS 9.8

9 known vulnerabilities affect 2.3.18 (highest CVSS 9.8).

Your branch 2.3 has reached end of life (Jun 30, 2021).

58 newer releases in its track, up to 2.7.8. What changed up to 2.7.8

Vulnerabilities affecting 2.3.18

9.8
CVE-2024-27903 OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privilege… fixed in 2.5.10
9.8
CVE-2022-0547 OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an ex… fixed in 2.4.12
9.1
CVE-2018-7544 A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are conne…
7.8
CVE-2024-27459 The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges. fixed in 2.5.10
7.8
CVE-2021-3606 OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code wit… fixed in 2.5.3
7.5
CVE-2026-11771 OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM re… fixed in 2.6.21
7.5
CVE-2024-24974 The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive serv… fixed in 2.5.10
7.5
CVE-2020-20813 Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet.
7.5
CVE-2020-15078 OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potent… fixed in 2.4.11

Newer releases

2.7.8	Oct 6, 2026	2.3.18 → 2.7.8
2.7.7	Sep 3, 2026	2.3.18 → 2.7.7
2.7.6	Aug 4, 2026	2.3.18 → 2.7.6
2.7.5	Jul 1, 2026	2.3.18 → 2.7.5
2.7.4	Apr 30, 2026	2.3.18 → 2.7.4
2.7.3	Apr 27, 2026	2.3.18 → 2.7.3
2.7.2	Apr 21, 2026	2.3.18 → 2.7.2
2.7.1	Mar 31, 2026	2.3.18 → 2.7.1
2.7.0	Feb 11, 2026	2.3.18 → 2.7.0
2.6.23	Sep 23, 2026	2.3.18 → 2.6.23
2.6.22	Aug 5, 2026	2.3.18 → 2.6.22
2.6.21	Jul 1, 2026	2.3.18 → 2.6.21
2.6.20	Apr 22, 2026	2.3.18 → 2.6.20
2.6.19	Feb 4, 2026	2.3.18 → 2.6.19
2.6.18	Feb 3, 2026	2.3.18 → 2.6.18