CVE-2020-36992: 
NordVPN vulnerability analysis and mitigation

CVE-2020-36992 is an unquoted service path vulnerability in NordVPN version 6.31.13.0 that allows local attackers to execute arbitrary code with elevated (LocalSystem) privileges. The flaw resides in the nordvpn-service Windows service, which uses an unquoted binary path susceptible to path-hijacking attacks. It was published on January 28, 2026, and assigned by VulnCheck. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (Feedly, VulnCheck).

The root cause is CWE-428 (Unquoted Search Path or Element). On Windows, when a service's binary path contains spaces and is not enclosed in quotation marks, the Service Control Manager attempts to resolve the path by testing each space-delimited segment as a potential executable. A local attacker with write access to a parent directory in the path can place a malicious executable at a location that Windows resolves before the legitimate binary (e.g., C:\Program.exe or C:\Program Files\NordVPN.exe). Exploitation requires a low-privileged local account and is triggered on system startup or service restart, requiring no user interaction. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB, VulnCheck, InfinitSec).

Successful exploitation grants the attacker code execution under the LocalSystem account, the highest privilege level on a Windows system, resulting in full confidentiality, integrity, and availability compromise of the affected host. An attacker can install persistent backdoors, disable security controls, access all local credentials and data, and use the compromised system as a pivot point for lateral movement within the network. The impact is limited to systems where NordVPN 6.31.13.0 is installed and where a local (low-privileged) attacker can write to a directory in the unquoted service path (Feedly, VulnCheck).

A public proof-of-concept exploit for this vulnerability is available on Exploit-DB (EDB-ID 48790), lowering the bar for exploitation (Exploit-DB). The EPSS score is approximately 0.011% (0.000110), indicating a currently low probability of widespread automated exploitation. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, which limits its attack surface compared to network-exploitable vulnerabilities.

1. Reconnaissance: Identify a target Windows system running NordVPN 6.31.13.0. Confirm the vulnerable service path by running sc qc nordvpn-service or querying the registry at HKLM\SYSTEM\CurrentControlSet\Services\nordvpn-service to observe the unquoted ImagePath value containing spaces.
2. Identify hijackable path segment: Parse the unquoted service binary path (e.g., C:\Program Files\NordVPN\nordvpn-service.exe) and identify which parent directory segments are writable by the low-privileged attacker (e.g., C:\ or C:\Program Files\).
3. Place malicious executable: Craft a malicious executable (e.g., a reverse shell or privilege-escalating payload) and place it at the path Windows will resolve first — for example, C:\Program.exe or C:\Program Files\NordVPN.exe — depending on write permissions.
4. Trigger service restart: Wait for or trigger a system reboot or service restart. The Windows Service Control Manager will resolve the unquoted path and execute the attacker's binary before the legitimate NordVPN service binary.
5. Achieve LocalSystem execution: The malicious executable runs under the LocalSystem account, granting full control of the system (Exploit-DB, InfinitSec, ctrlaltnod).

• Registry: Inspect HKLM\SYSTEM\CurrentControlSet\Services\nordvpn-service — the ImagePath value should be quoted; an unquoted path is the vulnerable condition.
• File System: Presence of unexpected executables in path segments such as C:\Program.exe, C:\Program Files\NordVPN.exe, or other space-delimited path prefixes that should not contain executables.
• Logs: Windows System Event Log entries (Event ID 7045 or 7036) showing the nordvpn-service starting unexpectedly or from an unusual binary path; Security Event Log entries (Event ID 4688) showing process creation under SYSTEM context from unexpected parent paths.
• Process: Unusual processes (e.g., cmd.exe, powershell.exe, or unknown binaries) running as NT AUTHORITY\SYSTEM spawned around service startup times without a clear legitimate parent.

Users should upgrade NordVPN to a version newer than 6.31.13.0, as the vendor is expected to have addressed this in subsequent releases by quoting the service binary path. As a workaround, administrators can manually correct the service path by running sc config nordvpn-service binPath= "\"C:\Program Files\NordVPN\nordvpn-service.exe\"" from an elevated command prompt to add the required quotation marks. Additionally, restrict write permissions on directories in the service path (e.g., C:\Program Files\NordVPN\) to prevent non-administrative users from placing malicious executables (VulnCheck, Exploit-DB).

The vulnerability received limited but notable coverage from security aggregators and blogs upon its CVE publication in January 2026, despite the underlying flaw originating around 2020. Security researchers published technical write-ups on platforms such as InfinitSec and ctrlaltnod, and the vulnerability was discussed on Bluesky by CVE tracking accounts. No official public statement from NordVPN specifically addressing CVE-2020-36992 has been identified (InfinitSec, ctrlaltnod).