CVE-2026-9560 Privilege escalation in OpenVPN Connect

Critical 9.4 Published 26 May 2026 Updated 27 May 2026

Local attackers can execute arbitrary commands with elevated privileges via the background service IPC channel in OpenVPN Connect for macOS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-9560?

CVE-2026-9560 is a critical vulnerability in OpenVPN Connect, published on 26 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel

Weakness: CWE-648, CWE-78, CWE-270, CWE-267

Which versions are affected by CVE-2026-9560?

It affects 1 product.

Products include Openvpn Connect.

How do I fix CVE-2026-9560?

No fix has been published for CVE-2026-9560 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-9560 being exploited?

There is no known exploitation of CVE-2026-9560 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-26rp-gp3x-v78c.