Loading story…
An incorrect authorization vulnerability in NordVPN for Windows, tracked as CVE-2026-106030, allows a low-privileged local attacker to impersonate a trusted process through a NordVPN named pipe and invoke service-management methods. The flaw affects all versions before 8.12 and can be used to stop arbitrary unprotected Windows services and change their startup type to Manual, potentially causing denial of service for critical system services.
Nord Security fixed the vulnerability in NordVPN 8.12 following coordinated disclosure by CERT Polska after a report from Marcin Ressel. Windows-protected services, including Windows Defender, cannot be stopped or reconfigured through this flaw. Organizations should update affected Windows installations to version 8.12 or later. Neither CERT Polska's notice nor the Malware News repost reports active exploitation.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The disclosure describes how a low-privileged local attacker can impersonate a trusted process through NordVPN's named pipe and invoke service-management methods, potentially causing denial of service. Windows-protected services, including Windows Defender, cannot be stopped or reconfigured through the flaw.
NordVPN version 8.12 fixes the incorrect authorization vulnerability affecting all earlier Windows versions. The flaw allowed a low-privileged local attacker to stop arbitrary unprotected Windows services and change their startup type to Manual.
Marcin Ressel responsibly reported the vulnerability later assigned CVE-2026-106030 to CERT Polska, which participated in coordinating its disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate local privilege-escalation issues were disclosed in widely deployed Windows remote-access clients. WatchGuard published an advisory for **NCP IPSec VPN Client** as shipped with *WatchGuard Mobile VPN with IPSec* for Windows, where installation/update/uninstall actions can briefly open interactive `cmd.exe` windows running as **SYSTEM**; on older Windows versions, an attacker with local access can execute commands in that prompt to gain **SYSTEM** privileges and bypass administrative protections. WatchGuard states the issue affects versions up to **15.19** and is fixed in **15.33** (advisory **WGSA-2026-00002**, tracked as **NCPVE-2025-0626**). Separately, reporting described a privilege-escalation weakness in **Check Point Harmony SASE (Perimeter81) Windows client** tracked as **CVE-2025-9142**, affecting versions **below 12.2**. The issue is attributed to insufficient validation of **JWT** values passed via a URI handler (`perimeter81://`) to a SYSTEM-privileged service component (`Perimeter81.Service.exe`), enabling directory traversal (e.g., `../../../`) and file write/delete outside the intended certificate working directory; the described attack chain includes crafting a malicious URL, abusing a whitelisted auth domain, and using symlink/object-manager tricks to redirect certificate writes performed with SYSTEM privileges, potentially leading to full local compromise.
Jun 29, 2026
Microsoft disclosed several **Windows Simple Search and Discovery Protocol (SSDP) Service** elevation-of-privilege vulnerabilities, including `CVE-2026-32082`, `CVE-2025-48815`, `CVE-2025-47975`, and `CVE-2025-59196`, indicating a recurring security issue affecting the Windows SSDP component. The advisories identify the flaws as local privilege-escalation bugs that could allow an attacker with existing low-privilege access to gain **administrator-level** rights on a vulnerable system. For `CVE-2026-32082`, Microsoft said the issue stems from a **race condition** (`CWE-362`) and rated it **Important** with a **CVSS 3.1 score of 7.0**. The company described exploitation as requiring local access and low privileges, with **high impact** to confidentiality, integrity, and availability if successful. Microsoft said exploitation was considered less likely, was not publicly disclosed or known to be exploited at publication, and that a security update was available.
Jun 29, 2026
Microsoft disclosed four vulnerabilities in OpenVPN that can be chained to let an attacker gain full control of affected Windows systems, combining **remote code execution**, **local privilege escalation**, and service disruption. The issues affect OpenVPN versions earlier than **2.6.10** and were presented by Microsoft researchers at Black Hat USA 2024 after being patched by the OpenVPN project in March 2024. The vulnerabilities are tracked as `CVE-2024-27459`, `CVE-2024-24974`, `CVE-2024-27903`, and `CVE-2024-1305`, and impact components including `openvpn.exe`, `openvpnserv.exe`, and the `tap-windows6` driver. Microsoft and CSIRT.SK said a remote attacker could chain the flaws to achieve full system compromise, prompting administrators and users to upgrade OpenVPN to **2.6.10 or later**.
Jul 24, 2026