NordVPN patches "clumsy" Windows bug that let attackers disable system services

A vulnerability in NordVPN's Windows app allowed local attackers to stop unprotected system services.

The flaw, officially tracked as CVE-2026-106030, does not affect NordVPN version 8.12.0.0 or later Experts label the bug "clumsy," but the actual impact on users is minimal, requiring a device to already be compromised by malware.

Nord Security has rolled out an important security update for its Windows application to address a vulnerability that could allow a hacker to stop unprotected Windows services.

The flaw allowed a local, low-privileged attacker to act as a trusted process.

From there, they could potentially stop unprotected Windows services or change their startup types to manual, leading to a denial of service for those specific applications.

When a top-tier provider, frequently ranked as the best VPN on the market, flags a security patch of this nature, it naturally turns heads.

However, cybersecurity experts stress that while the coding error shouldn't have happened, the real-world danger to users is incredibly low.

The issue, officially tracked as CVE-2026-106030 , was responsibly reported to CERT Polska by IT Security Expert Marcin Ressel.

NordVPN appears to have fixed the vulnerability in version 8.12.0.0, and users are simply advised to ensure their app is fully up to date.

How the vulnerability works (Image credit: NordVPN) To understand the bug, you have to look at how Windows applications talk to each other using a feature called "named pipes." According to an intelligence brief published by Mallory , the vulnerability allowed an attacker to connect to a specific NordVPN named pipe and invoke methods to stop services or change their start types without proper authorization.

Mike Williams, Technical Editor at TechRadar, explains the core of the issue: "Named pipes are a common means for Windows processes to communicate with each other.

One process might send a message to another asking it to carry out some task." Because this communication channel is incredibly powerful, it is a frequent target for threat actors.

"Because named pipes are so sensitive, hackers often try to abuse them, to run these tasks without permission," Williams notes.

"That means it's important to secure them, and make sure that only messages from legitimate processes are accepted.