Medium severity · published Oct 22, 2026
CVE-2026-106017
Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions
New
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
O3
OpenVPN 3 Core Library · OpenVPN
3.4 through 3.11.7 · source: vendor