Patch & vulnerability status
NordVPN 8.8
Latest tracked version 8.8. Release status, tracked CVEs, and automated cross-platform patching for NordVPN.
Category: VPN and Zero Trust
| Platform | Latest version | CVEs tracked | Last checked |
|---|---|---|---|
| Windows | 8.8 | 4 | 2026-08-10 |
Known vulnerabilities (CVEs) in NordVPN
Lavawall tracks 4 published CVEs affecting NordVPN, and deploys the versions that fix them automatically across your fleet.
| CVE | Published | Severity | Details | Vector |
|---|---|---|---|---|
| CVE-2019-25572 | 2026-03-21 13:16:21 | MEDIUM (7) | NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste a buffer of 100,000 characters into the email field during login to trigger an application crash. | LOCAL |
| CVE-2018-9105 | 2018-03-27 23:29:00 | HIGH (9) | NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately this XPC service is not protected, which allows arbitrary applications to connect and send it XPC messages. An attacker can send a crafted XPC message to the privileged helper tool requesting it make a new OpenVPN connection. Because he or she controls the contents of the XPC message, the attacker can specify the location of the openvpn executable, which could point to something malicious they control located on disk. Without validation of the openvpn executable, this will give the attacker code execution in the context of the privileged helper tool. | NETWORK |
| CVE-2018-3952 | 2018-09-07 15:29:01 | HIGH (9) | An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. A specially crafted configuration file can cause a privilege escalation, resulting in the execution of arbitrary commands with system privileges. | LOCAL |
| CVE-2018-10170 | 2018-04-16 21:29:01 | HIGH (10) | NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a class instance argument that provides attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user. | NETWORK |
Why keeping NordVPN patched matters
Unpatched third-party applications are one of the most common ways attackers get in: 57% of breached MSP clients and 32% of ransomware cases trace back to a missing patch. Every NordVPN release that fixes a security bug is public, so attackers see it too, and an out-of-date install becomes a documented way in. Tracking the installed version on every machine and closing the gap quickly is what turns a disclosed CVE into a non-event.
How Lavawall® patches NordVPN
Lavawall® watches NordVPN releases and CVEs continuously, ranks each update by risk, and deploys it across your whole fleet, Windows, macOS, and Linux, from a single agent, independently of your RMM. You get one place to see which machines are behind on NordVPN, one policy to bring them current, and timestamped evidence for audits.
Frequently asked questions
Lavawall tracks NordVPN at version 8.8 (last checked 2026-08-10). New releases are monitored continuously and can be deployed automatically across your fleet.
Lavawall tracks 4 CVEs for NordVPN and remediates them automatically as part of patching.
Deploy the Lavawall® agent and NordVPN updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Lavawall® monitors releases and CVEs for NordVPN through public information and proprietary statistical analysis, and can patch it automatically across your fleet.