CVE-2026-39312

CVE-2026-39312 is a pre-authentication denial-of-service vulnerability affecting SoftEtherVPN Developer Edition version 5.2.5188 and earlier. An unauthenticated remote attacker can crash the vpnserver process by transmitting a single malformed EAP-TLS packet over raw L2TP protocol on UDP port 1701, resulting in termination of all active VPN sessions and service disruption. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity, making it easily exploitable by remote threat actors. The impact is limited to availability, as the vulnerability does not compromise confidentiality or integrity of data. Current exploitation status indicates low community attention and no active exploitation in the wild. The EPSS score of 0.0025 suggests minimal likelihood of exploitation compared to other known vulnerabilities. Notably, this vulnerability does not appear on the CISA Known Exploited Vulnerabilities list and is classified as inactive on threat tracking platforms, indicating it has not become a priority target for threat actors despite its technical exploitability.