CVE-2026-106030: Missing Authorization in NordVPN for Windows
NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe "\\.\pipe\nord-security\v1\NordVpnService\Server". The attacker can then invoke the "ISettingsGrpc.StopService" and "ISettingsGrpc.ChangeServiceStartType" methods with an arbitrary service name, allowing them to stop any unprotected Windows service and change its startup type. This leads to denial of service of critical system services. Services protected by Windows (PPL processes, Windows Tamper Protection), such as Windows Defender, cannot be stopped or reconfigured.
This issue was fixed in version 8.12
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NordVPN for Windowsto a version that resolves this vulnerability.Fixed in 8.12
Event History
Frequently Asked Questions
Who can exploit this issue?
A local low-privileged attacker who can run code on the affected Windows system can connect to the NordVPN named pipe and invoke the exposed service-management methods. Remote access alone is not described as sufficient.
Which services are at risk?
Any unprotected Windows service may be stopped or have its startup type changed to Manual by supplying its service name. Services protected by Windows, including PPL processes and services protected by Windows Tamper Protection such as Windows Defender, cannot be stopped or reconfigured through this issue.
What is the impact of successful exploitation?
An attacker can cause denial of service by stopping critical Windows services and preventing them from automatically starting by changing their startup type to Manual. The described impact is service disruption rather than execution with elevated privileges.
What version resolves the issue?
The issue was fixed in NordVPN for Windows version 8.12.