ExpressVPN patches Home windows bug that uncovered distant desktop visitors

ExpressVPN has launched a brand new patch for its Home windows app to shut a vulnerability that may go away distant desktop visitors unprotected. If you happen to use ExpressVPN on Home windows, obtain model 12.101.0.45 as quickly as attainable, particularly for those who use Distant Desktop Protocol (RDP) or some other visitors by way of TCP port 3389.

ExpressVPN introduced each the vulnerability and the repair in a blog post earlier this week. In response to that submit, an unbiased researcher going by Adam-X despatched in a tip on April 25 to assert a reward from ExpressVPN’s bug bounty program. Adam-X seen that some inside debug code which left visitors on TCP port 3389 unprotected had mistakenly shipped to clients. ExpressVPN launched the patch about 5 days later in model 12.101.0.45 for Home windows.

As ExpressVPN factors out in its announcement of the patch, it is unlikely that the vulnerability was really exploited. Any hypothetical hacker wouldn’t solely have to concentrate on the flaw, however would then must trick their goal into sending an internet request over RDP or different visitors that makes use of port 3389. Even when all of the dominos fell, the hacker may solely see their goal’s actual IP deal with, not any of the particular information they transmitted.

Even when the hazard was small, it is good to see ExpressVPN responding proactively to flaws in its product — bug bounties are nice, however a safety product ought to shield its customers with as many safeguards as attainable. Along with closing this vulnerability, they’re additionally including automated checks that test for debug code by chance left in manufacturing builds. This, plus a successful independent privacy audit earlier in 2025, offers the robust impression of a supplier that is up to the mark.

If you happen to purchase one thing by way of a hyperlink on this article, we could earn fee.