The NordVPN Windows vulnerability, tracked as CVE-2026-106030, lets malware that is already on your PC stop certain Windows services. NordVPN fixed it in version 8.12, so open the app and update. Nobody can trigger it remotely, and no attacks have been reported.
Here are the quick facts:
- Affected: NordVPN for Windows, every version before 8.12
- Fixed in: 8.12.0.0 and later
- Severity: 6.8 out of 10 (CVSS v4, medium)
- Attack type: local only, so the attacker needs access to your PC first
- Exploited in the wild: not reported
If you only read one line, make it this: check your version number today. The rest is context on why the risk is small.
What the NordVPN Windows vulnerability actually does
The bug is a missing authorization check. NordVPN’s Windows app talks to its own background service through a named pipe, which is a channel programs on the same PC use to pass messages. That channel should only accept messages from trusted NordVPN processes.
It didn’t check. According to the CVE record, a low-privileged local user could connect to the pipe and act as a trusted process. From there, they could stop some Windows services or switch their startup type to Manual, so they won’t start with the PC.
The result is a denial of service for those services, not a data leak. TechRadar called the flaw “clumsy,” and the researcher who reported it to CERT Polska, Marcin Ressel, described it as a local privilege escalation with limited impact.
What this flaw can and can’t do
It’s easy to read “vulnerability in a VPN” and picture stolen traffic. This one is far narrower, as the table shows.
| Question | Answer |
|---|---|
| Can someone exploit it over the internet? | No. The attacker must already be running code on your PC. |
| Does it expose your VPN traffic? | No. The VPN itself isn’t affected. |
| Can it switch off Windows Defender? | No. Services protected by Windows, such as Defender, can’t be stopped this way. |
| Can it disable other services? | Yes, services that Windows doesn’t protect can be stopped or set to Manual. |
| Has it been used in attacks? | No active exploitation has been reported so far. |
The practical worry is a second-stage trick. Malware that lands on your PC could use this bug to quietly switch off a security tool that Windows doesn’t shield. That’s the scenario the patch closes.
How to check you have NordVPN 8.12 or newer
Open the NordVPN app on your PC and look for the app version in its settings or about section. You want 8.12.0.0 or higher. If you left automatic updates on, you probably have it already.
If the number is lower, install the latest version from NordVPN’s official site or let the app update itself. Avoid third-party download sites. Fake installers are a common way to get malware onto a PC in the first place.
Why a medium-severity bug still deserves a quick update
A 6.8 score doesn’t sound urgent, and for most home users it isn’t an emergency. But local bugs matter more when something else has already gone wrong, such as a malicious download or a stolen password.
Patching closes the easy follow-up step. It’s the same logic behind keeping everything current, from the Windows updates we covered recently to apps that run with high privileges. For a bigger example of why quick patching pays off, see our write-up on the Ivanti Connect Secure zero-day patch.
Security apps are a favorite target because they run with system-level access. A VPN or antivirus tool deserves the same update habit as Windows itself.
Frequently Asked Questions
Is NordVPN safe to use after this vulnerability?
Yes, once you’re on version 8.12 or later. The flaw didn’t affect the VPN connection itself, and the fix is already available.
What is CVE-2026-106030?
It’s the identifier for the missing-authorization flaw in NordVPN’s Windows app. It carries a CVSS v4 score of 6.8 and is classed as incorrect authorization (CWE-863).
Do I need to uninstall NordVPN?
No. Updating to 8.12 or newer is enough.
Does this affect Mac, Android, or iPhone users?
The reports only describe the Windows app. Nothing in the sources we checked says other platforms are affected.
My take: this is a “do it in two minutes” update, not a reason to panic or ditch your VPN. Check the version, update if you’re behind, and move on. The bigger lesson is to keep any app that runs with high privileges on automatic updates, because the bug that matters is rarely the one you were watching for.
Leave a Reply