Scoring two OpenVPN flaws against your own exposure, not the internet's

Numbers are easy to collect and hard to interpret. For CVE-2026-88964 and CVE-2026-84790, three different quantities get confused: fingerprint matches on the internet, installations in your estate, and installations that actually meet the advisory's preconditions.

The internet number

ZoomEye reports 2,181,390 assets matching app="OpenVPN" and 1,737,572 for app="OpenVPN" && port="1194" on the search date. A separate query for vul.cve="CVE-2026-88964" returned zero.
The phrase that matters is fingerprint match. A service that responds like an OpenVPN endpoint is not necessarily running an affected build, and a client installation on a laptop never appears in such a count. Treat the figure as a population estimate for context, never as an affected-host count.

The estate number

Query endpoint management and configuration management for installed client versions. Split by platform, because the CVE-2026-88964 scope is Windows and Android only while CVE-2026-84790 covers every platform from 2.3.0 through 2.7.7.
Split again by role. Servers that validate certificates belong to the second flaw's scope. Clients belong to both.

The precondition number

This is the number that should drive prioritisation. For the client flaw, count endpoints whose profiles permit connecting to servers outside the organization. For the identity flaw, count authorization rules that depend on the certificate subject field.
A deployment of 20,000 clients that always connect to one internal gateway has a far smaller precondition set than a deployment of 2,000 clients with public provider profiles. The reverse can be true for the identity flaw, where a large partner certificate population raises the count of issuable subjects.

Reading severity alongside reach

CVE-2026-88964 scores 7.1 in CVSS 4.0 with low complexity and no attack requirements, and the affected range is short. CVE-2026-84790 scores 7.6 with high complexity and attack requirements present, and the affected range reaches back to 2.3.0.
A short range with easy exploitation and a long range with hard exploitation can land in the same change window, which is what 2.7.8 offers. The prioritisation still differs inside the window: the mobile and desktop 2.7 clients first, the certificate review in parallel.

A reporting format that does not mislead

State three lines separately: how many OpenVPN endpoints exist in the estate, how many run an affected version, and how many match the advisory precondition. Add the internet fingerprint count with a label that says it is not an affected-host count.
Neither advisory documents a workaround, and both close with 2.7.8. A report that lists a version, a date and a precondition count is defensible. A report that lists a single large internet number as the exposure is not.