A flaw in NordVPN's Windows app let a low-privileged user on a machine shut down Windows services and stop them starting automatically again, by talking to the VPN's privileged background service as if they were a trusted process. Nord Security has fixed it in version 8.12.
The bug, CVE-2026-106030, was disclosed on October 16 by CERT Polska, which received the report and coordinated disclosure with the vendor. Credit for finding it goes to researcher Marcin Ressel. All NordVPN for Windows versions before 8.12 are affected. CERT Polska classes it as Incorrect Authorization (CWE-863) and did not publish a CVSS score.
A trusted pipe that trusted too much
The NordVPN service listens on a named pipe, a local channel Windows programs use to talk to each other, at \\.\pipe\nord-security\v1\NordVpnService\Server. According to CERT Polska, the NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to that pipe. From there, the attacker can call two methods, ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType, with any service name they choose.
That lets an attacker stop any unprotected Windows service and change its startup type to Manual, so it does not come back on its own. CERT Polska describes the impact as denial of service of critical system services. It is a local flaw: the attacker has to be able to run code on the computer first.
Windows Defender is out of reach
There is a hard limit on the damage. Services protected by Windows itself, such as Protected Process Light (PPL) processes or those covered by Tamper Protection, cannot be stopped or reconfigured this way. CERT Polska names Windows Defender as one of them, so the bug does not give an attacker a route to switching off Microsoft's built-in antivirus.
Update NordVPN for Windows to 8.12
The fix is in NordVPN for Windows 8.12, and users and administrators should confirm installed clients are on that version or later. CERT Polska's advisory does not describe a workaround for older versions and does not report exploitation in the wild.
The disclosure is the latest of many coordinated by Poland's national CERT. It is also a familiar lesson for desktop software that runs with high privileges: a privileged service has to check who is talking to it, and here that check fell short.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.