DoS in VPNSSL service

Advisory ID CVE Number Date discovered Severity Advisory revision
STORM-2026-029 CVE-2026-84732 09/07/2026 high v2

Vulnerability details

A security flaw has been discovered in OpenVPN, that can lead to a Denial of Service (DoS).

Impacted products

ProductsSeverityDetail
Stormshield Network Security high SNS is impacted.

Revisions

Version Date Description
v1 10/16/2026 Initial release
v2 10/20/2026 Advisory disclosure


Stormshield Network Security

CVSS v3.1 Overall Score: 7.2      

Analysis

Impacted version

The ACK packet retransmission logic in OpenVPN is susceptible to an integer overflow in the timeout calculation.

A remote unauthenticated attacker can exploit this by sending crafted packets, resulting in a denial of service.
  • SNS 5.1.0 to 5.1.3
  • SNS 5.0.0 to 5.0.9
  • SNS 4.8.0 to 4.8.19
  • SNS 4.3.0 to 4.3.44

Workaround solution

Solution

There is no workaround solution.

The following updates will fix this vulnerability:

  • SNS 5.1.4 EA
  • SNS 5.0.10
  • SNS 4.8.20 LTSB
  • SNS 4.3.45 QS


Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability impact
Network Low None None Unchanged None None Low
CVSS Base score: 5.3 CVSS Vector: (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploit Code Maturity Remediation Level Report Confidence
High Official fix Confirmed
CVSS Temporal score: 5.1 CVSS Vector: (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:C)
Attack Vector (MAV) Attack Complexity (MAC) Privileges Required (MPR) User Interaction (MUI) Scope (MS)
Network Low None None Unchanged
Confidentiality Impact (MC) Integrity Impact (MI) Availability Impact (MA)
None None High
Confidentiality Requirement (CR) Integrity Requirement (IR) Availability Requirement (AR)
Medium Medium Medium
CVSS Environmental score: 7.2 CVSS Vector: (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:C/CR:M/IR:M/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:H)