All vulnerabilities
CVE-2026-106030

Missing Authorization in NordVPN for Windows

Nord Security NordVPN
Open in ThreatlineRecord JSON
CVSS
6.8Medium
ExploitationExploitation reported1 outlet report it, first 20 Oct 2026. Not yet in the KEV catalogReports
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8.12Fixed versionCVE List
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 16 Oct 2026, 09:47 UTCPublishedCVE List
  2. 20 Oct 2026, 12:00 UTCFirst reported exploitedBluesky: zero-day
  3. NowNot on CISA's known exploited list yet

Reports 1

One outlet reports exploitation. Reports are not confirmation; each links to its source.

Description

NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe "\\.\pipe\nord-security\v1\NordVpnService\Server". The attacker can then invoke the "ISettingsGrpc.StopService" and "ISettingsGrpc.ChangeServiceStartType" methods with an arbitrary service name, allowing them to stop any unprotected Windows service and change its startup type. This leads to denial of service of critical system services. Services protected by Windows (PPL processes, Windows Tamper Protection), such as Windows Defender, cannot be stopped or reconfigured.

This issue was fixed in version 8.12

Text from CVE List

Affected versions 1

  • NordVPNaffected: all versions before 8.12CVE List

References 2