Patching to 2.7.8 closes CVE-2026-88964 and CVE-2026-84790. Several controls are worth keeping afterwards, because both flaws point at assumptions that outlive a version string.
Assumption one: the peer is trustworthy
CVE-2026-88964 is triggered by a server sending crafted domain search options. The fix corrects the parser, and the underlying design still gives a connecting server wide influence over a client's configuration.
Keeping a policy that constrains which servers clients accept remains useful, especially for mobile devices and for profiles distributed to contractors. So does reviewing the practice of handing out profiles that point at third-party providers.
Assumption two: a certificate subject is a trustworthy identity
CVE-2026-84790 exploited an embedded NUL in the subject field to make one certificate look like another identity. The fix at 2.7.8 closes that comparison path.
The durable control is issuance validation: reject non-printing characters when a certificate is requested. That protects against the same class of defect in other software that reads the same field, including plugins and portals built around the VPN.
Assumption three: a version string proves the control works
Verification by version number is necessary and thin. A test that presents a crafted certificate to a server and confirms rejection proves the behaviour that the advisory was about. Keep that test in a regression suite so a future downgrade or a replaced binary is caught.
Assumption four: exposure counts describe risk
ZoomEye reports 2,181,390 assets matching app="OpenVPN", and 1,737,572 for app="OpenVPN" && port="1194". Both are fingerprint populations. They are useful for finding internet-facing services that someone forgot, and they say nothing about client builds or certificate configuration.
A vulnerability-scoped query for vul.cve="CVE-2026-88964" returned zero results on the search date, which illustrates the limit: index coverage is not a risk statement.
Assumption five: the affected range matches the installed range
CVE-2026-84790 covers 2.3.0 through 2.7.7 across platforms, while CVE-2026-88964 covers 2.7_alpha3 through 2.7.7 on Windows and Android. Teams that track only recent releases will miss older installations that still validate certificates.
The practical close-out is a written record: endpoints at 2.7.8, issuance validation enabled, subject-based authorization rules reviewed, and the test that proves a malformed subject is rejected. Neither advisory documents a workaround, so the record is the evidence that the risk was handled rather than deferred.