Summary
- CVE-2026-106030 affects NordVPN for Windows versions earlier than 8.12.
- A local low-privilege attacker could stop or change the startup setting of unprotected Windows services.
- Protected Windows services such as Defender are excluded by existing Windows protections.
Poland’s national incident response team CERT Polska has coordinated disclosure of a security flaw in NordVPN for Windows that could allow a local attacker with limited privileges to stop certain Windows services or change how they start. The vulnerability, CVE-2026-106030, affects versions earlier than 8.12 and has been fixed in that release.
The issue arises from insufficient authorisation checks around communication with the NordVPN service. According to CERT Polska, a low-privilege process could interact with a named-pipe interface as though it were a trusted application and request operations against a service identified by name. The result could be denial of service for Windows components that are not protected from that kind of manipulation.
The report identifies the weakness as incorrect authorisation, CWE-863. It is a local attack condition, meaning the described abuse requires an attacker or malicious process already operating on the Windows machine. It is not a report that an unauthenticated user on the internet can take over a computer merely because NordVPN is installed, nor is it evidence that the VPN tunnel itself has been bypassed.
CERT Polska also draws an explicit boundary around protected Windows components. Services subject to Protected Process Light restrictions or Windows tamper protection, including the Defender protections described by the team, cannot be stopped or reconfigured using this particular issue. The affected operations instead concern services lacking those safeguards, and their importance depends on the local computer’s configuration.
Why a trusted helper needs strict authority checks
Desktop security and networking applications commonly rely on background services to perform tasks requiring permissions that ordinary users do not hold. A user-facing program asks the service to carry out authorised operations through an interprocess communication channel. That arrangement can simplify administration and keep privileged code separate from the interface, but it makes the service responsible for validating which requests are legitimate.
When a service accepts privileged requests from an untrusted local process, the effective boundary between a standard user and the system can weaken. In this case, the documented outcome is the ability to interfere with service availability and startup configuration rather than an unrestricted elevation to administrator or SYSTEM. An attacker may still find such interference useful if it disrupts monitoring, business applications, or other unprotected processes.
The local execution prerequisite changes which hosts are exposed to this weakness and which logs can support an investigation. Exposure depends on vulnerable software being installed and a local execution route already existing. Organisations that operate centrally managed Windows fleets can establish affected versions through software inventories, but an inventory does not determine whether any host was abused. That conclusion would require examination of relevant service changes and other endpoint evidence.
NordVPN’s fixed version is 8.12, according to the coordinated disclosure. The responsible report was credited to researcher Marcin Ressel. CERT Polska did not, in the published notice, describe a campaign exploiting the weakness in the wild or quantify a number of affected installations.
The named-pipe mechanism is a local communications design issue, so the vulnerable product can operate normally for legitimate users while still allowing requests from an unexpected process. Such flaws are easy to misunderstand when reduced to a CVE score or the name of a security product. The documented consequence here is interference with unprotected service operation, which could affect availability; neither CERT Polska nor the vendor’s fixed-version information establishes exfiltration of VPN traffic, interception of encrypted sessions, or internet-scale attacks.
The weakness lay in the helper service accepting requests to change other services without sufficiently checking the caller’s authority. The disclosed vulnerability has a specific scope, a published fix, and no reported evidence of mass exploitation in CERT Polska’s announcement.
