CVE-2025-10680

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-24 · updated 2026-10-19
Weakness: CWE-78

Description

OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use

Affected products

OpenVPN: from 2.7_alpha1 through 2.7_beta1

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-10680
https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00149.html

Get alerted when CVE-2025-10680 or the next vulnerability affects your stack