The flaw, discovered through the company’s bug bounty program, affected specific versions of the Windows client and allowed TCP traffic over port 3389 to bypass the VPN tunnel, potentially revealing users’ actual network locations to internet service providers and network observers. Users are strongly advised to update to the latest version of the ExpressVPN Windows application to ensure they benefit from these security enhancements and maintain optimal privacy protection during their VPN sessions. This code caused a critical routing failure where traffic using TCP port 3389, the standard port for Remote Desktop Protocol connections, would not be properly tunneled through the VPN infrastructure as intended. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. This type of exposure defeats the primary purpose of VPN protection, which is to mask users’ real network locations and maintain anonymity. Security researcher Adam-X responsibly disclosed the vulnerability to ExpressVPN through their bug bounty platform.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 22 Jul 2025 10:35:12 +0000