NordVPN EUVD-2026-102833

Requires local access to a Windows host running NordVPN prior to version 8.12 with a low-privileged (non-administrator) account (PR:L, AV:L); the attacker connects to the local named pipe \\.\pipe\nord-security\v1\NordVpnService\Server, which fails to verify caller privileges, and calls ISettingsGrpc.StopService / ISettingsGrpc.ChangeServiceStartType with an arbitrary service name. Limiting factors: exploitation is not possible remotely and needs an existing local foothold; NordVPN must be installed and running; and only unprotected services can be affected - services guarded by Windows (PPL processes, Tamper Protection, e.g. Windows Defender) cannot be stopped or reconfigured, bounding the blast radius.

The input provides only a CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L, base 6.8, MEDIUM), with no EPSS score, no CISA KEV listing, and no POC indicator supplied. All signals point to a locally-exploitable, moderate-impact issue rather than a widespread emergency: AV:L means the attacker already needs a foothold on the host, PR:L means a low-privileged (non-admin) account suffices, and the impact is confined to availability (VA:H) plus limited integrity (SI:L/SA:L) - no confidentiality loss (VC:N/VI:N). The root cause (CWE-863 Incorrect Authorization) is that the NordVpnService named pipe trusts any connecting process, letting a low-privileged user invoke privileged service-control methods. There is no conflict between the CVSS vector and the description - both agree this is local, low-privilege, availability-only. Key missing data: EPSS probability is absent so widespread-exploitation likelihood cannot be quantified, and no POC/exploit-code signal was provided, so exploitation maturity is unknown. A mitigating factor materially caps real-world severity: Windows-protected services (PPL processes, Tamper Protection - e.g. Windows Defender) cannot be stopped or reconfigured, so the attacker cannot trivially disable the primary endpoint defense. Net assessment: a legitimate local privilege/authorization flaw worth patching, but not a drop-everything remote-RCE-class priority.

A low-privileged user or malware already running on a Windows host with NordVPN prior to 8.12 impersonates a trusted process and connects to the \\.\pipe\nord-security\v1\NordVpnService\Server named pipe. It then calls ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType with the names of unprotected security, logging, or monitoring services to stop them and set their startup type to Manual, degrading defenses or causing denial of service. No public exploit identified at time of analysis; exploitation requires local access and low (AC:L) complexity.