NordVPN patches "clumsy" Windows bug that let attackers disable system services

A vulnerability in NordVPN's Windows app allowed local attackers to stop unprotected system services.

<![CDATA[ <article> <ul><li><strong>A vulnerability in NordVPN's Windows app allowed local attackers to stop unprotected system services.</strong></li><li><strong>The flaw, officially tracked as CVE-2026-106030, does not affect NordVPN version 8.12.0.0 or later</strong></li><li><strong>Experts label the bug "clumsy," but the actual impact on users is minimal, requiring a device to already be compromised by malware.</strong></li></ul><p>Nord Security has rolled out an important security update for its Windows application to address a vulnerability that could allow a hacker to stop unprotected Windows services.</p><p>The flaw allowed a local, low-privileged attacker to act as a trusted process. From there, they could potentially stop unprotected Windows services or change their startup types to manual, leading to a denial of service for those specific applications.</p><p>When a top-tier provider, frequently ranked as the<a href="https://www.techradar.com/vpn/best-vpn"> best VPN</a> on the market, flags a security patch of this nature, it naturally turns heads. However, cybersecurity experts stress that while the coding error shouldn't have happened, the real-world danger to users is incredibly low.</p><p>The issue, officially tracked as<a href="https://www.tenable.com/cve/CVE-2026-106030"> CVE-2026-106030</a>, was responsibly <a href="https://cert.pl/en/posts/2026/10/CVE-2026-106030/">reported </a>to CERT Polska by IT Security Expert Marcin Ressel. NordVPN appears to have fixed the vulnerability in version 8.12.0.0, and users are simply advised to ensure their app is fully up to date.</p><h2 id="how-the-vulnerability-works">How the vulnerability works</h2><figure class="van-image-figure inline-layout" data-bordeaux-image-check ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:1919px;"><p class="vanilla-image-block" style="padding-top:56.28%;"><img id="DNLsiQgDNuZzEN5z5KNdPk" name="Windows.jpg" alt="NordVPN Windows" src="https://cdn.mos.cms.futurecdn.net/DNLsiQgDNuZzEN5z5KNdPk-1920-80.jpg" mos="" align="middle" fullscreen="" width="1919" height="1080" attribution="" endorsement="" class="inline"></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="credit" itemprop="copyrightHolder">(Image credit: NordVPN)</span></figcaption></figure><p>To understand the bug, you have to look at how Windows applications talk to each other using a feature called "named pipes." </p><p>According to an intelligence brief published by<a href="https://mallory.ai/stories/01a14435-48ff-7594-8154-91da49d25449"> Mallory</a>, the vulnerability allowed an attacker to connect to a specific NordVPN named pipe and invoke methods to stop services or change their start types without proper authorization.</p><p>Mike Williams, Technical Editor at TechRadar, explains the core of the issue: "Named pipes are a common means for Windows processes to communicate with each other. One process might send a message to another asking it to carry out some task."</p><p>Because this communication channel is incredibly powerful, it is a frequent target for threat actors. "Because named pipes are so sensitive, hackers often try to abuse them, to run these tasks without permission," Williams notes. "That means it's important to secure them, and make sure that only messages from legitimate processes are accepted. Any good developer knows this: it's a fundamental aspect of using named pipes."</p><p>Unfortunately, the NordVPN Windows app, specifically versions earlier than 8.12, fell short of this standard. "NordVPN has failed to do that, which makes this a clumsy bug. It should never have happened," Williams adds.</p><h2 id="why-the-real-world-impact-is-minimal">Why the real-world impact is minimal</h2><p>While the technical details of the flaw, which carries a CVSS v4 base severity score of 6.8, sound alarming, the practical implications for the average user are far less dramatic.</p><p>In a<a href="https://www.linkedin.com/feed/update/urn:li:activity:7511832858077069312/"> </a><a href="https://www.linkedin.com/feed/update/urn:li:activity:7511832858077069312/" target="_blank">LinkedIn post</a>, the researcher who discovered the flaw, Marcin Ressel, described it as "a local privilege escalation with limited impact" that he found while "playing around with NordVPN for Windows."</p><p>Crucially, this exploit can't shut down critical, system-protected security services. Built-in defenses like Windows Defender and processes guarded by Windows Tamper Protection are entirely immune to this specific attack.</p><div><blockquote><p>"There's no impact on the VPN itself, and you would have to have malware running on your PC to even cause the issue"</p><p>Mike Williams, Technical Editor</p></blockquote></div><p>"But the impact of the bug is very small," Williams clarifies. "All an attacker can do is change the status of non-critical Windows services. That is, it can't turn off Windows Defender, but maybe it could disable something related to media playback. But even if it did that, it's only flipped a Windows setting, and once you understood the cause, you could just flip it back."</p><p>Furthermore, this vulnerability cannot be triggered remotely over the internet. An attacker would already need to have a local foothold on your machine to exploit it. There has also been no active exploitation of this flaw reported in the wild.</p><p>"In other words, there's no impact on the VPN itself, and you would have to have malware running on your PC to even cause the issue," Williams concludes. "(And if there's malware running on your device then you've much bigger problems than this.)"</p><p>If you are running NordVPN on Windows, your best defense is simple: open the app and confirm you are running version 8.12.0.0 or later.</p><div data-widget-type="review" data-model-name="NordVPN"></div> </article> ]]>