High severity7.8NVD Advisory· Published May 26, 2026· Updated May 27, 2026

CVE-2026-9560

Description

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenVPN/OpenVPNllm-fuzzy
Range: >=3.5.1, <=3.8.1

Patches

Vulnerability mechanics

References

openvpn.net/connect-docs/macos-release-notes.htmlnvdRelease Notes

News mentions

⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More
The Hacker News · Jun 1, 2026
Critical OpenVPN Connect for macOS Vulnerability Let Attackers Execute Arbitrary Commands
Cyber Security News · May 28, 2026

Severity

HighCVSS v3.1

7.8/ 10

CVSS v49.4

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Local
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Probability of exploitation in the next 30 days.

0.57%

VYPR risk score

Composite of severity, exploitation, and reach.

0.51high

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-267
Privilege Defined With Unsafe Actions
CWE-270
Privilege Context Switching Error
CWE-648
Incorrect Use of Privileged APIs
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE ID

CVE-2026-9560