# CVE-2026-106030: Incorrect Authorization in NordVPN for Windows Allows Low-Privileged Local Users to Stop/Reconfigure Services

> CERT Polska reports an incorrect authorization flaw (CWE-863) in NordVPN for Windows versions before 8.12. A low-privileged local user can reach the NordVPN service named pipe and invoke ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType with an arbitrary service name, stopping unprotected Windows services and setting their startup type to Manual. Fixed in 8.12.

- **Published:** 2026-10-16T11:59:48Z
- **Last reviewed:** 2026-10-16T11:59:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3736
- **ID:** TL-2026-3736
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-106030, CVE-2018-10170

## Description

CERT Polska published an advisory on 2026-10-16 for CVE-2026-106030, an incorrect authorization vulnerability (CWE-863) affecting all NordVPN for Windows versions before 8.12 (vendor: Nord Security). Per the advisory, NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes.

The NordVPN Windows service (running with elevated privileges) exposes a gRPC-style settings interface over the named pipe \\.\pipe\nord-security\v1\NordVpnService\Server. The pipe does not adequately authorize callers, so a low-privileged local user can connect and invoke the methods ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType, supplying an arbitrary Windows service name. The privileged NordVPN service then performs the stop or start-type change on the caller's behalf, i.e. a confused-deputy condition that lets an unprivileged user affect services they could not otherwise control.

Impact is limited to unprotected services: the advisory states that system-protected services such as Windows Defender are not affected. The effect is a denial of service against the targeted service and a persistent configuration change (start type set to Manual, so the service will not restart automatically after reboot). The advisory gives no CVSS score, no exploitation-in-the-wild information, no public PoC and no attribution; the MEDIUM severity is an analyst assessment (local vector, low privileges required, protected services unaffected), not a vendor rating. The issue was fixed in NordVPN for Windows 8.12 and was responsibly disclosed to CERT Polska by Marcin Ressel.

Defensive value: the named pipe path and the two method names are concrete hunting anchors. Defenders should look for non-NordVPN, low-privileged processes opening the NordVpnService pipe, and for unexpected service stops or start-type changes (Service Control Manager events 7040/7036, registry changes under HKLM\SYSTEM\CurrentControlSet\Services\<name>\Start) originating from the NordVPN service process.

## MITRE ATT&CK

- T1489 Service Stop
- T1685 Disable or Modify Tools
- T1543 Create or Modify System Process
- T1559 Inter-Process Communication

## Sources

- [Vulnerability in NordVPN software - CERT Polska](https://cert.pl/en/posts/2026/10/CVE-2026-106030/)
- [CVE Record: CVE-2026-106030](https://www.cve.org/CVERecord?id=CVE-2026-106030)
- [CERT Polska Coordinated Vulnerability Disclosure process](https://cert.pl/en/cvd/)
- [CWE-863: Incorrect Authorization](https://cwe.mitre.org/data/definitions/863.html)
- [NVD: CVE-2018-10170 (earlier NordVPN Windows named-pipe service flaw, related prior art)](https://nvd.nist.gov/vuln/detail/cve-2018-10170)
- [VerSprite advisory: NordVPN for Windows (earlier nordvpn-service named-pipe issue)](https://versprite.com/advisories/nordvpn-for-windows/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3736