NordVPN CVE-2026-106030 lets a local attacker stop Windows services

CERT Polska has disclosed CVE-2026-106030 in NordVPN for Windows. A local attacker with low privileges can connect to an inadequately protected named pipe and ask the service to stop an unprotected Windows service or change its startup type. Releases earlier than 8.12 are affected, and NordVPN 8.12 fixes the issue.

The details come from CERT Polska’s 16 October advisory. The team received the report and coordinated vulnerability disclosure. The public record classifies the issue as incorrect authorisation, CWE-863.

Breachroad’s conclusion: this is not a report of remote VPN-tunnel compromise or broken encryption. Exploitation requires local low-privileged access. The flaw may nevertheless help malware or a user already present on the endpoint disrupt services and enable further activity. Organisations should update every Windows installation, not only users actively connected to the VPN today.

How the flaw works

The NordVPN user application communicates with its service over the named pipe \\.\pipe\nord-security\v1\NordVpnService\Server. According to CERT Polska, a low-privileged process can act as a trusted application and connect to this channel.

It can then invoke ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType with an arbitrary service name. That can stop an unprotected system service or set its startup type to Manual. The result may be denial of service, loss of endpoint functionality or conditions that make a subsequent attack stage easier.

CERT Polska specifies that Windows-protected services, including PPL processes and services covered by Windows Tamper Protection, cannot be stopped or reconfigured this way. The advisory names Windows Defender as an example. That does not mean every important service receives the same protection.

What the public advisory does not establish

The advisory does not describe internet-based exploitation, interception of VPN traffic, credential theft or a bypass of tunnel encryption. It also does not report active exploitation of CVE-2026-106030. The local-access requirement means an attacker needs an earlier foothold, such as running malware or an account on the device.

That makes the exposure different from an unauthenticated network flaw, but it does not make the update unnecessary. Modern intrusions have several stages: phishing or a malicious installer may provide initial execution, after which a local flaw can weaken the system or interfere with normal operation.

Do not assume the issue applies to every Nord Security product or operating system. The official advisory identifies NordVPN for Windows. Separate evidence would be required for macOS, Linux, mobile applications or browser services.

What an individual should do

Open NordVPN’s settings or About view and check the application version. If it is earlier than 8.12, update through the built-in mechanism or the vendor’s official distribution channel. Restart the application and verify the version again.

On an employer-managed computer, do not bypass device-management policy. Report the outdated release to IT with the operating system, app version and any error shown. Do not obtain an “urgent NordVPN patch” from an advert, search result or link in an unexpected message.

If the computer behaves unexpectedly—services stop, applications fail after restart or startup settings change without planned administration—do not limit the response to reinstalling the VPN client. Report the symptoms and time so the security team can examine wider endpoint activity.

An organisational update plan

Start by inventorying NordVPN installations on Windows. Include laptops that rarely contact the corporate network, spare devices, operating-system images and contractor endpoints. Record the detected version, update channel, owner and last check-in time.

Then:

1. deploy 8.12 or a later approved release;
2. confirm the version of the application actually running;
3. verify that the update preserved the intended corporate VPN configuration;
4. resolve offline devices and failed installations;
5. update images and packages used to rebuild workstations;
6. record each exception with an owner and a short review date.

Where telemetry shows unexpected service stops, correlate the time with local processes, sign-ins and configuration changes. A changed startup type does not prove exploitation of this CVE—it may result from legitimate administration or another application. It is still a reason not to close the case with patch installation alone.

Explain the issue without unnecessary jargon

Employees do not need a description of gRPC or named pipes. They need an instruction: “NordVPN for Windows has received a security fix. Use the official update, verify version 8.12 or later and report any error to IT. Do not install updates from links in adverts or messages.”

The affected scope, mechanism and corrected version are facts from CERT Polska’s advisories. Inventory priorities, image maintenance and the investigation of unexpected service changes are Breachroad recommendations. Our VPN myths and facts guide gives broader user context, while the vulnerability management process explains how to make endpoint updates repeatable.