ExpressVPN has updated its Version 12 app for Windows following a tip from a security researcher about a routing problem.
The issue related to the way certain Remote Desktop traffic was being routed, and applied only under specific conditions — when a Remote Desktop Protocol (RDP) connection was in use or when other TCP traffic was routed over port 3389.
"As a result of the bug, if a user established a connection using RDP, that traffic could bypass the VPN tunnel. This did not affect encryption, but it meant that traffic from RDP connections wasn’t routed through ExpressVPN as expected," said the firm.
"As a result, an observer, like an ISP or someone on the same network, could have seen not only that the user was connected to ExpressVPN, but also that they were accessing specific remote servers over RDP — information that would normally be protected."
The company said it has now - with the help of its bug bounty community - fixed the issue.
It traced the problem to a piece of debug code - originally intended for internal testing, but which mistakenly made it into production builds, versions 12.97 to 12.101.0.2-beta.
The issue was reported on April 25 by security researcher Adam-X through its bug bounty platform, and ExpressVPN said its team confirmed and triaged the report within hours.
It released a fix five days later in the form of Version 12.101.0.45, with the update now rolled out across all distribution channels. It also includes other general improvements and routine bug fixes.
"The issue was confirmed as resolved by the researcher shortly after release, and the report was formally closed at the end of June," said the firm. "We’re grateful to Adam-X for responsibly disclosing this issue."
ExpressVPN calms user concerns
ExpressVPN said the issue would mainly affect users actively using RDP — a protocol that’s generally not used by typical consumers, meaning the number of affected users is probably small.
Meanwhile, the only data exposed by the breach would be the user’s real IP address. It wouldn't reveal their browsing activity or compromise the encryption of any traffic, including RDP sessions.
"To make sure this kind of issue doesn’t happen again, we’re strengthening our internal safeguards with more targeted checks to better catch debug code before it can reach production," said ExpressVPN.
"This includes improving automated tests to flag and remove test settings earlier in development, reducing the chance of human error and helping us deliver even stronger protections for our users."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
-
Thousands of exposed civil servant passwords are up for grabs onlineNews While the password security failures are concerning, they pale in comparison to other nations
-
Global PC shipments surge in Q3 2025, fueled by AI and Windows 10 refresh cyclesNews The scramble ahead of the Windows 10 end of life date prompted a spike in sales
-
Thousands of exposed civil servant passwords are up for grabs online
News While the password security failures are concerning, they pale in comparison to other nations
-
77% of security leaders say they'd fire staff who fall for phishing scams, even though they've done the same thingNews A new report uncovers worrying complacency amongst IT and security leaders
-
Hackers stole source code, bug details in disastrous F5 security incident – here’s everything we know and how to protect yourselfNews CISA has warned the F5 security incident presents a serious threat to federal networks
-
Hackers are using a new phishing kit to steal Microsoft 365 credentials and MFA tokens – Whisper 2FA is evolving rapidly and has been used in nearly one million attacks since JulyNews Whisper 2FA is now the third most common Phishing as a Service tool worldwide
-
Government urges large enterprises to shore up defenses as NCSC warns UK faces four 'nationally significant' cyber attacks every weekNews UK enterprises of all sizes face escalating cybersecurity threats, ministers have warned
-
Third time lucky? The FBI just took down BreachForums, again
News The hacking forum is down for now, but the group behind it, Scattered Lapsus$ Hunters, isn't going to stop extorting victims of the Salesforce breach
-
A malicious MCP server is silently stealing user emailsNews Koi Security says it's discovered the first malicious MCP server in the wild, exposing a risk to the entire ecosystem
-
NCA confirms arrest after airport cyber disruptionNews Disruption is easing across Europe following the ransomware incident
