ExpressVPN updates Windows app to fix vulnerability
The flaw was reported through ExpressVPN's bug bounty program
ExpressVPN has updated its Version 12 app for Windows following a tip from a security researcher about a routing problem.
The issue related to the way certain Remote Desktop traffic was being routed, and applied only under specific conditions — when a Remote Desktop Protocol (RDP) connection was in use or when other TCP traffic was routed over port 3389.
"As a result of the bug, if a user established a connection using RDP, that traffic could bypass the VPN tunnel. This did not affect encryption, but it meant that traffic from RDP connections wasn’t routed through ExpressVPN as expected," said the firm.
"As a result, an observer, like an ISP or someone on the same network, could have seen not only that the user was connected to ExpressVPN, but also that they were accessing specific remote servers over RDP — information that would normally be protected."
The company said it has now - with the help of its bug bounty community - fixed the issue.
It traced the problem to a piece of debug code - originally intended for internal testing, but which mistakenly made it into production builds, versions 12.97 to 12.101.0.2-beta.
The issue was reported on April 25 by security researcher Adam-X through its bug bounty platform, and ExpressVPN said its team confirmed and triaged the report within hours.
It released a fix five days later in the form of Version 12.101.0.45, with the update now rolled out across all distribution channels. It also includes other general improvements and routine bug fixes.
"The issue was confirmed as resolved by the researcher shortly after release, and the report was formally closed at the end of June," said the firm. "We’re grateful to Adam-X for responsibly disclosing this issue."
ExpressVPN calms user concerns
ExpressVPN said the issue would mainly affect users actively using RDP — a protocol that’s generally not used by typical consumers, meaning the number of affected users is probably small.
Meanwhile, the only data exposed by the breach would be the user’s real IP address. It wouldn't reveal their browsing activity or compromise the encryption of any traffic, including RDP sessions.
"To make sure this kind of issue doesn’t happen again, we’re strengthening our internal safeguards with more targeted checks to better catch debug code before it can reach production," said ExpressVPN.
"This includes improving automated tests to flag and remove test settings earlier in development, reducing the chance of human error and helping us deliver even stronger protections for our users."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
-
The trends that will shape workplace culture in 2026In-depth Tech leaders share their insights on how businesses can embrace change across hiring, training, and culture
-
Why the UK is primed to lead a global charge in ‘green AI’ innovationNews UKAI says there are major economic incentives and a big opportunity for the UK to lead the world in green AI development
-
90% of companies are woefully unprepared for quantum security threats – analysts say they need to get a move onNews Quantum security threats are coming, but a Bain & Company survey shows systems aren't yet in place to prevent widespread chaos
-
LastPass issues alert as customers targeted in new phishing campaignNews LastPass has urged customers to be on the alert for phishing emails amidst an ongoing scam campaign that encourages users to backup vaults.
-
NCSC names and shames pro-Russia hacktivist group amid escalating DDoS attacks on UK public servicesNews Russia-linked hacktivists are increasingly trying to cause chaos for UK organizations
-
An AWS CodeBuild vulnerability could’ve caused supply chain chaos – luckily a fix was applied before disaster struckNews A single misconfiguration could have allowed attackers to inject malicious code to launch a platform-wide compromise
-
There’s a dangerous new ransomware variant on the block – and cyber experts warn it’s flying under the radarNews The new DeadLock ransomware family is taking off in the wild, researchers warn
-
Supply chain and AI security in the spotlight for cyber leaders in 2026News Organizations are sharpening their focus on supply chain security and shoring up AI systems
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
How to MFA everywhereIndustry Insights Identity online is not who you are; it is what the system accepts as proof of you, and that gap is exactly what the attackers take advantage of
