NordVPN Patches Windows Flaw Allowing Local Attackers to Stop Unprotected Services
Nord Security has fixed CVE-2026-106030, a Windows app flaw that let local attackers stop some unprotected services; version 8.12.0.0 and later are unaffected.
The vulnerability allowed an attacker to act as a trusted process and connect to a specific NordVPN named pipe, then invoke methods to stop services or alter their start types without proper authorization, according to the report. It was responsibly reported to CERT Polska by IT security expert Marcin Ressel. The flaw carries a CVSS v4 base severity score of 6.8.
Mike Williams, technical editor at TechRadar, said named pipes are a common way for Windows processes to communicate and are a frequent target because they are sensitive. 'Because named pipes are so sensitive, hackers often try to abuse them, to run these tasks without permission,' Williams said. 'That means it's important to secure them, and make sure that only messages from legitimate processes are accepted. Any good developer knows this: it's a fundamental aspect of using named pipes.' He added that NordVPN failed to do so, calling it 'a clumsy bug' that 'should never have happened.'
The practical impact is limited. The exploit cannot shut down critical, system-protected security services; Windows Defender and processes guarded by Windows Tamper Protection are immune to this specific attack, according to TechRadar. An attacker could only change the status of non-critical Windows services, such as something related to media playback, and the setting could be changed back. The vulnerability cannot be triggered remotely over the internet, and an attacker would already need a local foothold on the machine. No active exploitation has been reported in the wild.
Ressel described the issue in a LinkedIn post as 'a local privilege escalation with limited impact' that he found while 'playing around with NordVPN for Windows,' according to the report. Williams said there is no impact on the VPN itself and that malware would already have to be running on a PC to cause the issue.
NordVPN users on Windows should open the app and confirm they are running version 8.12.0.0 or later, TechRadar reported.