Threat reportVulnerabilityTL-2026-3736
CVE-2026-106030: Incorrect Authorization in NordVPN for Windows Allows Low-Privileged Local Users to Stop/Reconfigure Services
CVE-2026-106030 (TL-2026-3736) is a medium-severity software vulnerability, first published 2026-10-16. It has no confirmed attribution, affects Nord Security NordVPN for Windows, references 2 CVEs (CVE-2026-106030, CVE-2018-10170), maps to 4 MITRE ATT&CK techniques (T1489, T1543, T1559), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3736
- Threat ID
- TL-2026-3736
- Severity
- MEDIUM
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, enterprise, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
How CVE-2026-106030 works
CERT Polska reports an incorrect authorization flaw (CWE-863) in NordVPN for Windows versions before 8.12. A low-privileged local user can reach the NordVPN service named pipe and invoke ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType with an arbitrary service name, stopping unprotected Windows services and setting their startup type to Manual. Fixed in 8.12.
CERT Polska published an advisory on 2026-10-16 for CVE-2026-106030, an incorrect authorization vulnerability (CWE-863) affecting all NordVPN for Windows versions before 8.12 (vendor: Nord Security). Per the advisory, NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes.
The NordVPN Windows service (running with elevated privileges) exposes a gRPC-style settings interface over the named pipe \\.\pipe\nord-security\v1\NordVpnService\Server. The pipe does not adequately authorize callers, so a low-privileged local user can connect and invoke the methods ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType, supplying an arbitrary Windows service name. The privileged NordVPN service then performs the stop or start-type change on the caller's behalf, i.e. a confused-deputy condition that lets an unprivileged user affect services they could not otherwise control.
Impact is limited to unprotected services: the advisory states that system-protected services such as Windows Defender are not affected. The effect is a denial of service against the targeted service and a persistent configuration change (start type set to Manual, so the service will not restart automatically after reboot). The advisory gives no CVSS score, no exploitation-in-the-wild information, no public PoC and no attribution; the MEDIUM severity is an analyst assessment (local vector, low privileges required, protected services unaffected), not a vendor rating. The issue was fixed in NordVPN for Windows 8.12 and was responsibly disclosed to CERT Polska by Marcin Ressel.
Defensive value: the named pipe path and the two method names are concrete hunting anchors. Defenders should look for non-NordVPN, low-privileged processes opening the NordVpnService pipe, and for unexpected service stops or start-type changes (Service Control Manager events 7040/7036, registry changes under HKLM\SYSTEM\CurrentControlSet\Services\<name>\Start) originating from the NordVPN service process.
MITRE ATT&CK techniques used in TL-2026-3736
Impact
Persistence
T1543 Create or Modify System Process
Execution
T1559 Inter-Process Communication
defense-impairment
Affected products and versions in CVE-2026-106030
- Nord Security — NordVPN for Windows
Vulnerable versions: all versions before 8.12
Fixed in: 8.12
Remediation for CVE-2026-106030
Patches
- NordVPN for Windows 8.12 (fixed version per CERT Polska advisory)
Immediate actions
- Upgrade NordVPN for Windows to version 8.12 or later on all endpoints
- Inventory endpoints running NordVPN for Windows versions earlier than 8.12
Workarounds
- No vendor workaround stated in the advisory; remove or disable NordVPN for Windows on multi-user systems until upgraded
Longer-term hardening
- Monitor Service Control Manager events and Services registry Start-value changes for unexpected stops or start-type changes
- Restrict installation of unmanaged VPN clients on managed endpoints via application control
CVEs associated with CVE-2026-106030
Weaknesses (CWE) in CVE-2026-106030
Timeline of CVE-2026-106030
- Prior art: CVE-2018-10170 published for NordVPN 6.12.7.0 for Windows, a SYSTEM privilege escalation via the nordvpn-service NetNamedPipe endpoint (related attack surface; not the same flaw).
- Threat ingested by Threadlinqs; no public PoC, exploitation in the wild, KEV listing or attribution stated in the source.
- Marcin Ressel credited with responsible disclosure of the flaw to CERT Polska under its coordinated vulnerability disclosure process.
- Advisory identifies NordVPN for Windows 8.12 as the fixed version; all earlier versions are affected.
- CVE-2026-106030 published (CWE-863, NordVPN for Windows before 8.12); no CVSS score provided in the advisory.
- CERT Polska published the advisory 'Vulnerability in NordVPN software' for CVE-2026-106030.
Sources cited for CVE-2026-106030
- Vulnerability in NordVPN software - CERT Polska
- CVE Record: CVE-2026-106030
- CERT Polska Coordinated Vulnerability Disclosure process
- CWE-863: Incorrect Authorization
- NVD: CVE-2018-10170 (earlier NordVPN Windows named-pipe service flaw, related prior art)
- VerSprite advisory: NordVPN for Windows (earlier nordvpn-service named-pipe issue)
Detection coverage for TL-2026-3736
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3736 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.