Technical information was given in the email but wouldn't fit in the above: "Technical Facts: The vulnerability relies on the fact that a direct route exists

Technical information was given in the email but wouldn't fit in the above: "Technical Facts: The vulnerability relies on the fact that a direct route exists between the VPN client and server. If the client accesses a forwarded port on the VPN server that is maliciously set up by an attacker, the client will use the direct route using the user's default route, bypassing the VPN entirely. Our initial fix was to block VPN clients from accessing forwarded ports on the same server at the VPN gateway firewall level, but we soon discovered a flaw in our desktop clients that made the fix incomplete. When the client disconnected, the direct route to the VPN gateway was not removed, thereby making users vulnerable even after they disconnected from the VPN. Beginning with v.52, we remove these "lingering" direct routes to the VPN gateway at disconnect time."