CVE-2026-39312highCWE-789

CVE-2026-39312: falha de alta gravidade em SoftEtherVPN

Pre-Auth EAP-TLS DoS on SoftEther VPN Developer Edition

Publicada em

Seguir esta CVE+ Monitorar SoftEther VPN

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. In 5.2.5188 and earlier, a pre-authentication denial-of-service vulnerability exists in SoftEther VPN Developer Edition 5.2.5188 (and likely earlier versions of Developer Edition). An unauthenticated remote attacker can crash the vpnserver process by sending a single malformed EAP-TLS packet over raw L2TP (UDP/1701), terminating all active VPN sessions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
SoftEtherVPN · SoftEtherVPN
CVEs relacionadas — SoftEtherVPN

No mesmo produto, das mais perigosas para as menos.

CVE-2024-38520MEDIUMSoftEther VPN with L2TP - 2.75x AmplificationEPSS 0.5%CVE-2025-32787LOWSoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRAEPSS 0.4%