CISA Warns of Notepad++ Code Execution Vulnerability Exploited in Attacks

CISA has added CVE-2025-15556 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting active exploitation of a critical code execution flaw in Notepad++, a widely used open-source text editor popular among developers and IT professionals.

Added on February 12, 2026, with a federal civilian executive branch (FCEB) patching deadline of March 5, 2026, the vulnerability stems from the WinGUp updater’s failure to perform integrity checks on downloaded code.

Attackers can intercept or redirect update traffic, tricking users into installing malicious payloads that execute arbitrary code with user-level privileges.

This flaw, classified under CWE-494 (Download of Code Without Integrity Check), poses severe risks in real-world attacks. Threat actors could leverage man-in-the-middle (MitM) techniques on unsecured networks to serve tampered installers, potentially deploying ransomware, malware droppers, or persistent backdoors.

While direct ties to ransomware campaigns remain unknown, the vulnerability’s simplicity, requiring no authentication or user interaction beyond routine updates, makes it ideal for supply chain-style compromises.

Notepad++’s prevalence on Windows endpoints amplifies exposure, especially in enterprise environments where manual updates are common.

CVE ID	CVSS Score	Description
CVE-2025-15556	TBD (NVD pending)	Notepad++ WinGUp updater downloads code without integrity verification, enabling attackers to redirect traffic and execute arbitrary code via a malicious installer. Affected versions prior to the patch; impacts Windows users.

Notepad++ developers have addressed the issue in version 8.8.9 and later, as detailed in their official clarification and community forum. The patch enforces cryptographic verification of update packages, thwarting interception attempts.

However, users on vulnerable versions (primarily 8.6 through 8.8.8) remain at risk if auto-updates are disabled—a common configuration for stability.

CISA urges immediate application of vendor patches, adherence to Binding Operational Directive (BOD) 22-01 for cloud-integrated services, or discontinuation of the product if mitigations are infeasible.

Organizations should scan endpoints for outdated Notepad++ installations using tools like Microsoft Defender or endpoint detection solutions, disable WinGUp temporarily, and enforce network segmentation to block MitM vectors.

Enable update notifications and verify downloads against official SHA-256 hashes from notepad-plus-plus.org.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.