Cyber Posture

CVE-2026-9560

High
Microsoft: not affectedMSmacOS: not affectedMacLinux: not affectedLnxMobile: not affectedMobNetwork: not affectedNetApplication: affectedAppOther: not affectedOth

Published: 26 May 2026

Published
26 May 2026
Modified
27 May 2026
KEV Added
—
Patch
—
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0004 14.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-9560 is a high-severity OS Command Injection (CWE-78) vulnerability in Openvpn Connect. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 14.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1559.003 XPC Services Execution
Adversaries can provide malicious content to an XPC service daemon for local code execution.
attack.mitre.org →
Why these techniques?

Local privilege escalation via IPC to macOS background service directly enables T1068; macOS XPC-style local IPC maps to T1559.003.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-78CWE-267CWE-270CWE-648
OWASP Top 10 Web 2025
A05:2025

Affected Products

openvpn
connect
3.5.1 — 3.8.2

EU & UK References

References