NordVPN patches Windows flaw CVE-2026-106030 that let attackers stop services

NordVPN has released version 8.12.0.0 of its Windows application to patch a vulnerability tracked as CVE-2026-106030. This update addresses a coding error that permitted local attackers to interfere with unprotected system services on affected devices.

The flaw allowed a local, low-privileged attacker to act as a trusted process within the application. According to TechRadar, this access could enable an attacker to stop unprotected Windows services or change their startup types to manual. Such actions could lead to a denial of service for those specific applications.

Context and Background

The vulnerability stemmed from how the NordVPN Windows app handled communication via named pipes. Named pipes are a common mechanism for Windows processes to communicate and request tasks from one another. An intelligence brief published by Mallory stated that the bug allowed attackers to connect to a specific NordVPN named pipe.

Once connected, attackers could invoke methods to stop services or alter start types without proper authorization. Mike Williams, Technical Editor at TechRadar, explained that named pipes are sensitive and frequently targeted by threat actors seeking to run tasks without permission.

Williams noted that securing these communication channels is a fundamental aspect of development. He emphasized that only messages from legitimate processes should be accepted. The NordVPN Windows app versions prior to 8.12 failed to meet this standard, leaving the communication channel improperly secured.

Who Is Affected

The issue affects users of the NordVPN Windows application running versions earlier than 8.12.0.0. The vulnerability was responsibly reported to CERT Polska by IT Security Expert Marcin Ressel. Nord Security has confirmed that version 8.12.0.0 and later are not affected by this flaw.

While the bug is significant from a coding perspective, cybersecurity experts describe the real-world danger as incredibly low. The flaw requires a device to already be compromised by malware for an attacker to exploit it. Consequently, the impact on users who have not already lost control of their device is minimal.

What should you do?

Users of the NordVPN Windows application should immediately update to version 8.12.0.0 or later to ensure they are protected against CVE-2026-106030. Those running older versions remain exposed to the risk of local attackers manipulating system services through the application's named pipes.

What to do and how to stay safe: NordVPN

• Check your NordVPN Windows application version and update to 8.12.0.0 or later if you are running an older build.
• Monitor system service status for unexpected changes or stops, which could indicate exploitation of this or similar flaws.
• Run regular malware scans to detect any existing compromises, as this vulnerability requires a pre-existing foothold to exploit.
• Review named pipe permissions on your system to ensure other applications are not exposing similar unauthorized access vectors.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-106030?

It is a vulnerability in NordVPN's Windows app that allowed local attackers to stop unprotected system services or change their startup types.

Which versions of NordVPN are affected?

Versions of the NordVPN Windows application earlier than 8.12.0.0 are affected by this vulnerability.

How severe is the risk to users?

Experts state the real-world risk is minimal because the flaw requires the device to already be compromised by malware.