Timeline discipline for the OpenVPN 2.7.8 change

An upgrade that closes two advisories at once needs a sequence that keeps the fast fix from crowding out the slow one. For OpenVPN 2.7.8 the fast fix is a client binary and the slow part is a certificate review.

Day zero: confirm scope

Collect version strings. The CVE record for CVE-2026-88964 limits the affected range to 2.7_alpha3 through 2.7.7 on Windows and Android. The record for CVE-2026-84790 covers 2.3.0 through 2.7.7 across platforms.
Write both ranges into the change ticket. They produce different lists, and a single line saying "upgrade OpenVPN" will hide the second list.

Days one to three: client binaries

Replace Windows and Android 2.7 clients with 2.7.8. Verify on the endpoint, since a server-side version check proves nothing about client binaries.
Export the list of clients that connect to servers outside the organization. Treat those as the priority subgroup, because the malicious-server precondition for the underflow becomes plausible there.

Days three to ten: certificate review

List the authorities that issue client certificates and the components that read subject fields for authorization. Include address assignment tables, per-user rules and plugins.
Run a staging test. Present a certificate with a non-printing character in a subject component to a 2.7.8 server and confirm it is rejected. Record the result in the ticket, because the behaviour change is the point of the fix.
Revoke any certificate whose subject field was malformed, and add issuance validation so the case cannot recur.

Days ten to fourteen: verification and closure

Sample endpoints for the version string on every platform, not only the first group. Confirm that a normal connection still works on Windows, Android, desktop Linux and macOS if the estate includes them.
Correlate crash reports from the change window. An increase after patching means something else may be in play, and the underflow advisory describes crashes as the observable symptom of the client flaw.

Reporting that survives review

Separate what was closed and what was measured. Both CVEs close with 2.7.8. The measurement is a count of upgraded endpoints and a list of reviewed authorization rules.
Do not quote a ZoomEye figure as affected hosts. The current search returns 2,181,390 assets for app="OpenVPN" and 1,737,572 for app="OpenVPN" && port="1194". These describe fingerprint matches, not vulnerable systems and not installed clients.
Finish with an owner and date for any endpoint that missed the window. Both advisories list no workaround, so a missed endpoint is an open risk rather than an accepted one.