Three vulnerabilities in OpenVPN up to 2.6.22 and 2.7.6, topped by an untrusted search path issue that enables binary planting during network configuration steps on Windows. Others include an argument parsing flaw in Windows allowing remote command execution via crafted certificates, and an unauthenticated remote Denial of Service (DoS) triggered by retransmissions of ACK packet IDs causing a timeout integer overflow. Affected: OpenVPN < 2.6.23 / < 2.7.7. Upgrade to 2.7.7.

CVE IDs: CVE-2026-84226, CVE-2026-84256, CVE-2026-84732.