The quick version: if NordVPN runs on any Windows PC you look after, make sure it's on 8.12 or later. The rest of this piece covers what the bug does, what it can't do, and where the headlines are a little louder than the facts.
What CERT Polska disclosed
CERT Polska says it received a report about the vulnerability and helped coordinate its disclosure. The advisory credits researcher Marcin Ressel for reporting it responsibly. The CVE record mirrored by the CIRCL vulnerability database also lists the "NordVPN development team" as a finder.
The short description: NordVPN for Windows lets local attackers stop unprotected Windows system services and set their startup type to Manual through named pipes.
The technical detail is specific:
- The channel: a low-privileged attacker can pose as a trusted process and connect to the named pipe "\\.\pipe\nord-security\v1\NordVpnService\Server".
- The methods: the attacker can then call "ISettingsGrpc.StopService" and "ISettingsGrpc.ChangeServiceStartType" with any service name, which lets them stop any unprotected Windows service and change its startup type.
- The limits: services protected by Protected Process Light (PPL) or Windows Tamper Protection, including Windows Defender, can't be stopped or reconfigured this way.
- The fix: updating to version 8.12 removes the vulnerability.
Section summary: CERT Polska is the primary source. The bug affects NordVPN for Windows before 8.12, lets a low-privileged local process ask the NordVPN service to stop or reconfigure unprotected services, and is fixed in 8.12.
Named pipes, and why this counts as a basic mistake
Named pipes are a standard way for Windows processes to talk to each other. In a typical VPN client, the app you click runs with your normal user rights, and a background service with higher privileges does the heavy work. The two talk over a channel like this one. The service has to check who is calling before it acts. Otherwise, any program on the machine can borrow the service's privileges.
That's the failure here. TechRadar technical editor Mike Williams told the outlet that restricting named-pipe messages to legitimate processes is something every good developer should know, and he called NordVPN's lapse a "clumsy bug" that should never have happened. Picture a building where the security desk lets anyone through as long as they hold the door like an employee would.
It's fair to ask why a VPN client exposes "stop this service" and "change this startup type" at all. VPN clients often have legitimate reasons to manage related components. The public advisory doesn't explain why these methods exist. What it does say is that they accepted an arbitrary service name, not just NordVPN's own components. That's the part that turns a plumbing feature into a security flaw.
Section summary: Taking privileged requests over a named pipe without properly checking the caller is a well-known anti-pattern. Here, the service-control methods would act on any service name.
Severity: medium, and the reasons matter
The CVE carries a CVSS v4 base score of 6.8. The vector lists a local attack vector, low attack complexity, no attack requirements, low privileges required and no user interaction. Impact on the vulnerable system is rated high for availability and none for confidentiality and integrity.
In plain English, an attacker who can already run code on the machine can knock things over, but this bug doesn't let them read your data or quietly change it. One more data point: the CISA-ADP enrichment shown in the CIRCL record marks exploitation as "none", automatable as "no" and technical impact as "partial".
Several things keep this from being a five-alarm fire:
- No remote attack path. An attacker has to be local. Something hostile must already be running on the PC.
- No tunnel compromise. Security firm Breachroad stresses that this isn't a remote VPN-tunnel compromise or broken encryption. Your VPN traffic isn't exposed by this bug.
- No public exploit so far. VulDB reports that technical details are known, but no exploit is available. Mallory's tracker also shows no public exploits yet. Mallory adds that neither CERT Polska's notice nor the Malware News repost reports active exploitation. Strictly speaking, that means nobody has reported exploitation. It doesn't prove nobody has tried.
- Defender is out of reach. Protected services, including Windows Defender, are explicitly excluded.
Where "harmless" goes too far
TechRadar's take leans hard on reassurance. Williams says all an attacker can do is change the status of non-critical services, and if that happens, you could simply flip the setting back. That's broadly fair for a home user. But it understates the official wording in two ways.
First, CERT Polska's own description says the flaw can lead to denial of service of critical system services. The protected-service exemption covers PPL and Tamper Protection services, not everything an administrator might consider critical. Breachroad makes the same point: the Defender exemption doesn't mean every important service gets the same protection.
Second, switching services to Manual can also stop them from starting automatically on later boots. A quiet change like that can survive a reboot, and plenty of people won't notice it until something breaks.
That matters because modern intrusions happen in stages. Breachroad notes that phishing or a malicious installer can provide the first foothold, and a local flaw can then weaken the system. Third-party tools that aren't PPL-protected are the obvious worry: backup agents, logging or monitoring services, update services. Even a Tamper Protection-hardened Defender doesn't make every other service on the box safe. That last point is industry analysis, not a claim from the advisory, but it's why "low impact" shouldn't turn into "ignore it."
There's also a small taxonomy wrinkle. CERT Polska classes the bug as CWE-863 (Incorrect Authorization). VulDB's entry instead says CWE is classifying the issue as CWE-404. And in a LinkedIn post quoted by TechRadar, Ressel called his find "a local privilege escalation with limited impact." The labels differ, but the description of the mechanism and the fixed version are the same everywhere.
Section summary: The bug's reach is limited and it doesn't touch the VPN tunnel. Still, CERT's own wording, the startup-type persistence and its possible use as a post-compromise helper are good reasons to patch promptly.
How to protect yourself
Home users
- Open NordVPN and check the version shown in the app. You can also find it under Windows Settings > Apps > Installed apps.
- If it's older than 8.12, update through the app's own update mechanism or NordVPN's official download. TechRadar suggests confirming you're on 8.12.0.0 or later. CERT's advisory states the threshold simply as 8.12.
- Check the version again after updating to make sure the new build is the one running.
- Ignore "urgent NordVPN patch" links in ads, search results or unexpected emails. A well-publicised CVE is exactly the kind of lure phishers love.
IT administrators
- Inventory first. Find every Windows endpoint with NordVPN installed, not just the machines actively connected today. Breachroad specifically suggests including rarely connected laptops, spare devices, rebuild images and contractor machines.
- Deploy 8.12 or later through your normal software distribution channel. Then confirm the running version and check that corporate VPN settings survived the update.
- Refresh golden images and packages so a rebuilt workstation doesn't come back vulnerable.
- Investigate odd service changes properly. A service that stopped unexpectedly, or one that suddenly has a Manual startup type, deserves a look at local processes, sign-ins and configuration history. As Breachroad cautions, a changed startup type doesn't by itself prove this CVE was exploited. Legitimate admin work or another app could be the cause.
- Employer-managed PC? Report an outdated client to IT instead of working around device-management policy.
The bigger picture
Privileged helper services in third-party Windows apps have been a common source of local privilege-escalation and denial-of-service bugs for years. VPN clients, hardware utilities and game launchers all ship a high-privilege service with a chatty pipe or RPC endpoint attached. Each one adds attack surface to a PC. It's a useful reminder that "security software" isn't automatically secure software.
The good news is that the process worked as intended. A researcher found the flaw and reported it through a national CERT, the vendor shipped a fix, and the advisory came with specific, checkable detail.
For most readers, dealing with CVE-2026-106030 takes about two minutes: check the version and update if needed. Fleet administrators have a slightly longer job, because it involves an inventory sweep.
If you've seen any odd service behaviour on a machine running an older NordVPN build, or need help pushing the update across a fleet, tell us in the Windows security and enterprise IT forums.