n/a OpenVPN Access Server

Name: n/a OpenVPN Access Server
Brand: n/a

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

critical

by severity

0critical5high2medium0low

updated 2026-10-27

vulnerabilities (7)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-36382US	high7.5	1.89% (79th)	—	no fix	2021-06-04	≤ 2.7.3 to 2.8.7
CVE-2020-15077US	medium5.3	1.21% (68th)	—	no fix	2021-06-04	≤ 2.8.7 and earlier versions
CVE-2020-15074US	high7.5	1.04% (64th)	—	no fix	2020-07-14	≤ 2.8.3 and prior versions in addition to 2.9.5
CVE-2022-33738US	high7.5	0.92% (60th)	—	no fix	2022-07-06	≤ until 2.11
CVE-2021-4234US	high7.5	0.89% (59th)	—	no fix	2022-07-06	≤ 2.10 and prior version
CVE-2022-33737US	high7.5	0.87% (59th)	—	no fix	2022-07-06	≤ from version 2.10.0 and before 2.11.0
CVE-2021-3824US	medium6.1	0.75% (55th)	—	no fix	2021-09-23	≤ 2.9.0 through 2.9.4

The flaw types (CWEs) most of these CVEs share.

CWE-287Improper Authentication1 CVEs
CWE-302Authentication Bypass by Assumed-Immutable Data1 CVEs
CWE-305Authentication Bypass by Primary Weakness1 CVEs
CWE-331Insufficient Entropy1 CVEs
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)1 CVEs
CWE-406Insufficient Control of Network Message Volume (Network Amplification)1 CVEs
CWE-532Insertion of Sensitive Information into Log File1 CVEs
CWE-613Insufficient Session Expiration1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.