The fix for CVE-2026-84790 ships in OpenVPN 2.7.8. The condition that made the flaw useful sits earlier in the chain, at the point where an authority signs a certificate whose subject field contains a null byte.
What the authority should reject
Subject fields carry attributes such as common name, organizational unit and email address. Standards describe how to encode them, and a policy can state which characters are acceptable.
A simple rule covers the flaw's shape: reject any attribute containing a non-printing character, including NUL, and reject attributes whose encoded length disagrees with the decoded string. The rule applies to common names most of all, because that is the attribute most tools read as identity.
Where enrollment tooling leaks the value
Self-service portals often accept a display name and pass it into a signing request. A paste from another system can carry a null byte, and a form that only checks for emptiness will forward it.
Automation does the same thing at scale. A script that reads a username from a directory and builds a subject string inherits whatever the directory allows.
The corrective measure is a validation step between input and signing, applied to every attribute the policy names. Rejecting at issuance is cheaper than discovering the case after a server has accepted the certificate.
Existing certificates
An estate can hold certificates issued years ago under looser rules. Inventory the authorities, then search issued certificates for attributes with non-printing characters. Many certificate management tools can export subject attributes for inspection.
Where a match appears, revoke and reissue. The vulnerability is fixed in 2.7.8, so the revoked certificate no longer bridges an identity, but an attacker who already holds it may retain a copy. Revocation addresses that.
Ties to the rest of the estate
The same subject fields may be read by authorization plugins, portals and monitoring tools that were never part of the VPN upgrade. Their own software may or may not handle NUL correctly. Issuance hygiene removes the input that those readers could misinterpret.
This is why the certificate work should not be deferred until after the outage window for the 2.7.8 deployment. Both are inexpensive, and only one of them can be done by a package manager.
Evidence and scope
CVE-2026-84790 affects OpenVPN 2.3.0 through 2.7.7 and scores 7.6 in CVSS 4.0 with high complexity and attack requirements present. The advisory documents no workaround, so the fixed release 2.7.8 plus issuance validation is the complete answer.
ZoomEye reports 2,181,390 assets matching app="OpenVPN". That is a fingerprint count of internet-facing services. It cannot enumerate issued certificates, and it is not evidence about a specific organization's enrollment practices.
The enrollment rule survives the incident. Anywhere a field becomes an identity, validate it once at creation and compare it with length-awareness afterwards.