Full Report
Incorrect Authorization vulnerability (CVE-2026-106030) has been found in NordVPN software.
Analysis Summary
# Vulnerability: NordVPN for Windows Named Pipe Incorrect Authorization Allows Local Stopping of Unprotected Services
## CVE Details
- CVE ID: CVE-2026-106030
- CVSS Score: Not provided in the source article
- CWE: CWE-863 (Incorrect Authorization)
## Affected Systems
- Products: NordVPN for Windows (vendor: Nord Security)
- Versions: All versions before 8.12
- Configurations: The issue affects the NordVPN user-mode application's named pipe interface on Windows. The article does not describe other configuration requirements. Services protected by Windows (PPL processes and Windows Tamper Protection, such as Windows Defender) are not affected.
## Vulnerability Description
NordVPN's user-mode application does not properly verify which client is connecting to its service interface. A low-privileged local user can connect to the named pipe `\\.\pipe\nord-security\v1\NordVpnService\Server` and act as a trusted process. From there, the attacker can call the gRPC methods `ISettingsGrpc.StopService` and `ISettingsGrpc.ChangeServiceStartType` with an arbitrary service name. This allows them to:
- Stop any unprotected Windows service
- Change that service's startup type to Manual
Repeated or targeted use of these actions can cause denial of service for critical system services. The article reports that the issue is fixed in version 8.12.
## Exploitation
- Status: Not reported as exploited in the wild. The article does not mention a public PoC, though it describes the attack path in enough detail to be reproduced.
- Complexity: Not stated by the source. Exploitation appears to require only local, low-privileged access and the ability to connect to the named pipe (analysis based on the description).
- Attack Vector: Local
## Impact
- Confidentiality: Not stated in the source. No data exposure is described.
- Integrity: Limited (analysis). The attacker can change service startup configuration, but the article does not describe code execution or data modification.
- Availability: High for affected systems. Attackers can stop unprotected services, including critical ones, causing denial of service.
## Remediation
### Patches
- Upgrade NordVPN for Windows to version 8.12 or later, per the vendor fix referenced by CERT Polska.
### Workarounds
- No workarounds are documented in the source.
- Until patching is complete, limit local interactive access to systems running vulnerable NordVPN versions, and enforce least privilege for local user accounts.
- If patching is delayed, consider uninstalling NordVPN or disabling it on high-value systems (a general recommendation, not from the source).
## Detection
- Indicators of compromise: The article does not publish IOCs. Watch for unexpected stops of non-protected services or unexpected startup-type changes to Manual, especially when NordVPN is running.
- Detection methods and tools (suggested, not from the source):
- Review Windows System logs for Event ID 7040 (service start type changed) and Event ID 7036 (service state changed) and correlate them with user sessions.
- Monitor for unusual connections to named pipes under `\\.\pipe\nord-security\`, using endpoint detection tools that can log named pipe activity.
- Audit the installed NordVPN version across endpoints to identify systems still running builds older than 8.12.
## References
- CERT Polska advisory: hxxps://cert[.]pl/en/posts (original article: "Vulnerability in NordVPN software," 16 October 2026)
- CVE record: hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-106030
- CWE-863: hxxps://cwe[.]mitre[.]org/data/definitions/863[.]html
- CERT Polska coordinated vulnerability disclosure policy: hxxps://cert[.]pl/en/cvd/
- Credit: Marcin Ressel (reporter)