CVE-2026-9560 | CVE Tracker

Description

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel

Scores

CVSS scores of CVE-2026-9560, by who scored it
Scored by	CVSS	Score	Vector
OpenVPNCNA (assigner)	4.0	Critical9.4	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
OpenVPNCNA (assigner)	4.0	High8.9	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVDNVD · Analyzed	4.0	Critical9.4	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.57% · top 52% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.

Weakness

CWE-78 (opens in a new tab)All about CWE-78 and its CVEs
CWE-267 Privilege defined with unsafe actions (opens in a new tab)All about CWE-267 and its CVEs
CWE-270 Privilege context switching error (opens in a new tab)All about CWE-270 and its CVEs
CWE-648 Incorrect use of privileged APIs (opens in a new tab)All about CWE-648 and its CVEs

Affected products

OpenVPN Inc · OpenVPN Connect
- affected 3.5.1 – ≤ 3.8.1

References (1)

https://openvpn.net/connect-docs/macos-release-notes.html (opens in a new tab)release-notes

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-9560](https://trackcve.app/badge/CVE-2026-9560.svg)](https://trackcve.app/cve/CVE-2026-9560)

Record last updated 27 May 2026, 03:55 UTC.

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands…