OpenVPN on Ubuntu: install the fix, then restart the service
Ubuntu fixes possible impersonation by authenticated OpenVPN users. Four Ubuntu releases have an updated package to install, followed by a service restart.
Going deeper
Generated image · SecuFocus
At a glance
Key points
Do you administer OpenVPN on Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS or 26.10? Ubuntu’s USN-8953-1 notice, published on 22 October, calls for a package update and an OpenVPN restart. Incorrect handling of certificate subject fields could allow an authenticated remote user to impersonate another user.
Connecting is only part of the identity check
Ubuntu identifies the flaw as CVE-2026-84790. Its notice describes an authenticated remote user, not an unauthenticated visitor able to open any VPN. Incorrect handling of certificate subject fields could let that user impersonate someone else and gain unintended access to network services.
For an administrator, a connected tunnel is therefore not enough: the recognised identity must also match the intended permissions. The notice does not provide a complete authorisation audit procedure or report active exploitation. We have not reproduced the vulnerability.
The NVD record describes upstream versions 2.7_alpha1 through 2.7.7 inclusive, while Ubuntu also supplies fixed packages in its 2.5 and 2.6 branches. Those scopes do not match. NVD has no CPE configuration yet: do not declare an Ubuntu package safe from its version prefix alone; follow the distribution advisory.
Compare the full Ubuntu package version
Ubuntu lists the following fixed openvpn packages. Their suffixes matter: a distribution can include a fix without adopting the same version number as an upstream release. Compare your installed package with the row for your Ubuntu release.
| Ubuntu release | Fixed openvpn package |
|---|---|
| 22.04 LTS | 2.5.11-0ubuntu0.22.04.6 |
| 24.04 LTS | 2.6.19-0ubuntu0.24.04.5 |
| 26.04 LTS | 2.7.0-1ubuntu1.4 |
| 26.10 | 2.7.7-1ubuntu1.1 |
Plan for disconnection before restarting
Ubuntu explicitly requires an OpenVPN restart after the standard system update. Installing the package alone does not establish that the running process is using the corrected code.
If this VPN is your only remote administration route, prepare a fallback you control and a maintenance window before stopping the service. After updating, check the package, the restart and a fresh authorised connection. Then use a test account and non-sensitive data to check that access is limited to the intended resources. This is our maintenance recommendation, not a vulnerability test supplied by Ubuntu.
One OpenVPN notice does not describe every VPN
This list covers the Ubuntu packages named in USN-8953-1. It cannot establish the status of a commercial app, router or another operating system using OpenVPN. For a managed service, ask the operator how it is addressing this CVE; do not replace its app with a package intended for your server.
The patch does not review active accounts or network permissions for you. Keep those checks separate: maintained software on one side, intended access on the other.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- NIST NVD: CVE-2026-84790, description and CNA versions ↗services.nvd.nist.gov ·
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.