ExpressVPN patches Home windows bug that uncovered distant desktop visitors

ExpressVPN has launched a brand new patch for its Home windows app to shut a vulnerability that may depart distant desktop visitors unprotected. Should you use ExpressVPN on Home windows, obtain model 12.101.0.45 as quickly as potential, particularly should you use Distant Desktop Protocol (RDP) or every other visitors by way of TCP port 3389.

ExpressVPN introduced each the vulnerability and the repair in a blog post earlier this week. In keeping with that put up, an unbiased researcher going by Adam-X despatched in a tip on April 25 to say a reward from ExpressVPN’s bug bounty program. Adam-X seen that some inside debug code which left visitors on TCP port 3389 unprotected had mistakenly shipped to clients. ExpressVPN launched the patch about 5 days later in model 12.101.0.45 for Home windows.

As ExpressVPN factors out in its announcement of the patch, it is unlikely that the vulnerability was truly exploited. Any hypothetical hacker wouldn’t solely have to pay attention to the flaw, however would then must trick their goal into sending an internet request over RDP or different visitors that makes use of port 3389. Even when all of the dominos fell, the hacker might solely see their goal’s actual IP deal with, not any of the particular information they transmitted.

Even when the hazard was small, it is good to see ExpressVPN responding proactively to flaws in its product — bug bounties are nice, however a safety product ought to shield its customers with as many safeguards as potential. Along with closing this vulnerability, they’re additionally including automated assessments that verify for debug code unintentionally left in manufacturing builds. This, plus a successful independent privacy audit earlier in 2025, offers the robust impression of a supplier that is up to the mark.

Should you purchase one thing by way of a hyperlink on this article, we might earn fee.