CVE-2026-106030 Nord Security CVE debrief

Who should care

System administrators and security teams responsible for managing Windows systems and NordVPN for Windows installations should assess exposure and verify that systems are updated to version 8.12 or later. They should also implement additional monitoring to prevent potential denial of service and security disruptions. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, checking relevant monitoring,

Why it matters

CVE-2026-106030 is a medium-severity vulnerability in NordVPN for Windows that allows local attackers to stop unprotected Windows system services and change their startup type. System administrators and security teams should assess exposure, verify updates, and implement additional monitoring to prevent potential denial of service and security disruptions.

• Denial of service of critical system services
• Potential disruption of security services like Windows Defender
• Requires verification of affected versions and remediation status
• Potential impact on system availability and security

Technical summary

The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe '\\.\pipe\nord-security\v1\NordVpnService\Server'. The attacker can then invoke the 'ISettingsGrpc.StopService' and 'ISettingsGrpc.ChangeServiceStartType' methods with an arbitrary service name, allowing them to stop any unprotected Windows service and change its startup type. This leads to denial of service of critical system services. Services protected by Windows (PPL processes, Windows Tamper Protection), such as Windows Defender, cannot be stopped or reconfigured.

Defensive priority

Medium

Recommended defensive actions

• Review and update NordVPN for Windows to version 8.12 or later
• Implement additional monitoring for service changes
• Restrict access to named pipes
• Verify service protection
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in NordVPN for Windows, which allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.