14:06Machine-translated from Azerbaijani by AIRead in Azerbaijani
NordVPN fixes vulnerability that could stop Windows services
Nord Security has fixed a security vulnerability found in the Windows app for its NordVPN service. An attacker who had already placed malware on the device could exploit the vulnerability to stop some unprotected services. The issue is not present in versions 8.12.0.0 and later. The risk is considered low because malware must already be running on the computer for the attack to work.
The vulnerability, designated CVE-2026-106030, received a score of 6.8 on the CVSS v4 severity scale. An attacker with limited access privileges on the computer could impersonate a trusted application. This made it possible to stop certain services or change their startup setting from automatic to manual. As a result, those applications would temporarily stop working. Security researcher Marcin Ressel discovered the issue and reported it to CERT Polska. The vulnerability stemmed from special communication channels that Windows applications use to exchange data with one another. An attacker could connect to the NordVPN app’s channel and send commands without an authorization check. Such channels, which provide extensive access privileges, should accept requests only from trusted applications. However, before version 8.12, this check was not performed adequately. The vulnerability cannot disable critical or system-protected services. Windows Defender and Windows Tamper Protection are not affected by the attack, and the VPN connection is not disrupted. An attacker can only change the status of less important processes, such as services related to media playback. Once the cause is identified, the modified setting can be restored to its previous state. This vulnerability cannot be exploited remotely over the internet. An attacker must first gain local access to the computer. So far, there have been no reports of the issue being exploited in real-world attacks. NordVPN users should open the app and check the installed version. Updating the software to version 8.12.0.0 or later is sufficient to remain secure.
The vulnerability, designated CVE-2026-106030, received a score of 6.8 on the CVSS v4 severity scale. An attacker with limited access privileges on the computer could impersonate a trusted application. This made it possible to stop certain services or change their startup setting from automatic to manual. As a result, those applications would temporarily stop working. Security researcher Marcin Ressel discovered the issue and reported it to CERT Polska. The vulnerability stemmed from special communication channels that Windows applications use to exchange data with one another. An attacker could connect to the NordVPN app’s channel and send commands without an authorization check. Such channels, which provide extensive access privileges, should accept requests only from trusted applications. However, before version 8.12, this check was not performed adequately. The vulnerability cannot disable critical or system-protected services. Windows Defender and Windows Tamper Protection are not affected by the attack, and the VPN connection is not disrupted. An attacker can only change the status of less important processes, such as services related to media playback. Once the cause is identified, the modified setting can be restored to its previous state. This vulnerability cannot be exploited remotely over the internet. An attacker must first gain local access to the computer. So far, there have been no reports of the issue being exploited in real-world attacks. NordVPN users should open the app and check the installed version. Updating the software to version 8.12.0.0 or later is sufficient to remain secure.