CVE-2026-9560

Vulnerability

The vulnerability resides in the macOS privileged helper component of OpenVPN Connect versions 3.5.1 through 3.8.1. Attackers can execute arbitrary commands with elevated privileges by sending crafted messages over the local IPC channel. The privileged helper runs with root privileges and improperly validates IPC messages, enabling command injection.

Exploitation

An attacker with local access to the macOS system can exploit this vulnerability by interacting with the background service via the local IPC channel. No user interaction is required; the attacker simply sends malicious IPC messages to trigger command execution. The attacker does not need prior authentication to the service beyond having local access.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges, leading to full system compromise. This includes the ability to install malware, modify system files, access sensitive data, and persist elevated access.

Mitigation

OpenVPN released version 3.8.2 on May 25, 2026, which fixes this vulnerability [1]. Users should upgrade to 3.8.2 or later. No workarounds are available for unpatched versions.