Missing authorization in NordVPN for Windows lets local users stop services
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
NordVPN for Windows before 8.12 lets a local attacker with low privileges stop unprotected Windows system services and change their startup type to Manual through a named pipe. The NordVPN user-mode application lets an attacker act as a trusted process and call the StopService and ChangeServiceStartType methods with an arbitrary service name. This is an incorrect authorization flaw (CWE-863) that causes denial of service of system services, while services protected by Windows, such as Windows Defender, cannot be stopped or reconfigured.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe "\\.\pipe\nord-security\v1\NordVpnService\Server". The attacker can then invoke the "ISettingsGrpc.StopService" and "ISettingsGrpc.ChangeServiceStartType" methods with an arbitrary service name, allowing them to stop any unprotected Windows service and change its startup type. This leads to denial of service of critical system services. Services protected by Windows (PPL processes, Windows Tamper Protection), such as Windows Defender, cannot be stopped or reconfigured. This issue was fixed in version 8.12
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nord Security | NordVPN | before 8.12 | 8.12 | Patch available | CNA |
- NordVPN VendorNord Security Affected before 8.12 Fixed in 8.12 Patch available CNA
Remediation
Update NordVPN for Windows to version 8.12, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA NordVPN (Nord Security) Fixed in 8.12
Timeline
- 2026-10-16 Threatist record created from CVE-2026-106030
- 2026-10-16 Alias added: GHSA-g85w-3p3f-vrj3
References
Other 1
Sources
- CVE-2026-106030 · CVE Program
- CVE-2026-106030 · NVD
- FIRST EPSS
- GHSA-g85w-3p3f-vrj3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences