Executive assessment
Today's brief leads with OpenVPN: Authentication Bypass by Spoofing. All 3 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Patch order: Finding 02 (POC exists; zlib is foundational; patches available for all listed Ubuntu versions); Finding 01 (No reported exploitation; comprehensive OpenVPN patches for all Ubuntu LTS versions (22.04–26.10); interim certificate controls available if patching delayed).
Finding 01 — OpenVPN: Authentication Bypass by Spoofing
What changed: It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
Technical evidence: CVE-2026-84790; CVSS v4.0 7.6; weakness CWE-290, CWE-158; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patching, block or revoke certificates containing embedded NUL bytes in subject fields, and prevent the certificate authority from issuing such certificates. CISA ADP Vulnrichment reports exploitation as "none". ([github.com](https://github.com/OpenVPN/openvpn/commit/cf4384eef4676a01bd3ee98fa602f7b2af8079ea.patch), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-84790), [community.openvpn.net](https://community.openvpn.net/Security%20Announcements/CVE-2026-84790), +1 more)
Affected: OpenVPN 2.3.0 through 2.7.7. ([community.openvpn.net](https://community.openvpn.net/Security%20Announcements/CVE-2026-84790))
Fix: Upstream OpenVPN 2.7.8. Ubuntu fixes: 2.7.7-1ubuntu1.1 for 26.10, 2.7.0-1ubuntu1.4 for 26.04 LTS, 2.6.19-0ubuntu0.24.04.5 for 24.04 LTS, and 2.5.11-0ubuntu0.22.04.6 for 22.04 LTS. ([community.openvpn.net](https://community.openvpn.net/Security%20Announcements/CVE-2026-84790), [ubuntu.com](https://ubuntu.com/security/CVE-2026-84790?format=md))
Panel assessment: OpenVPN 2.3.0–2.7.7 allows an authenticated attacker to inject NUL bytes into certificate subject fields and impersonate other users; no exploitation reported and EPSS is 12th percentile, but authentication bypass is a structural risk. An attacker with a malformed certificate can spoof user identity to downstream services trusting OpenVPN authentication. (priority: this week)
Action: Map CVE-2026-84790 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8953-1)
Finding 02 — zlib: Out-of-bounds Write
What changed: Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service or arbitrary code execution.
Technical evidence: CVE-2026-85091; CVSS v4.0 8.3; weakness CWE-787; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: CISA ADP Vulnrichment reports proof-of-concept exploitation. ([gist.github.com](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-85091), [ubuntu.com](https://ubuntu.com/security/CVE-2026-85091))
Affected: zlib 1.3.1.2 through 1.3.2. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-85091))
Fix: Ubuntu zlib: 26.10: 1:1.3.dfsg+really1.3.2-3ubuntu1.1; 26.04 LTS: 1:1.3.dfsg+really1.3.1-1ubuntu3.2; 24.04 LTS: 1:1.3.dfsg-3.1ubuntu2.3. ([ubuntu.com](https://ubuntu.com/security/CVE-2026-85091))
Panel assessment: Patch immediately: PoC exists with CVSS 8.3 enabling RCE via heap buffer overflow in zlib 1.3.1.2–1.3.2; exploitation is not automatable, limiting spread to targeted attacks. Attack surface is applications using asynchronous compression (web servers, logging, tunnels); successful exploitation corrupts heap memory, risking credential leakage or code injection. (priority: patch now)
Action: Map CVE-2026-85091 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8954-1)
Finding 03 — USN-8947-1: NSS update
What changed: This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised. (Unconfirmed, single-source.)
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
fixed version or patch state unknown
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8947-1)