OpenVPN Connect echo-script ACE — unexpected child process spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•12

Detects OpenVPN Connect spawning unexpected child processes such as command interpreters or scripting engines, which indicates potential exploitation of the echo-script arbitrary code execution vulnerability (CVE-2026-45115). This vulnerability allows attackers to push a malicious echo directive via the VPN server configuration that forces the client to execute arbitrary commands upon disconnection.