CISA Warns: Notepad++ Code Execution Vulner Vulnerability Exploited

CISA has added CVE-2025-15556 to its Known Exploited Vulnerabilities (KEV) catalog. The agency’s move highlights active exploitation of a critical code execution flaw impacting Notepad++, a widely used open-source text editor popular among developers and IT professionals.

Added on February 12, 2026, with a federal civilian executive branch (FCEB) patching deadline of March 5, 2026, the vulnerability stems from the WinGUp updater’s failure to perform integrity checks on downloaded code.

Attackers can intercept or redirect update traffic, tricking users into installing malicious payloads that execute arbitrary code with user-level privileges.

This flaw, classified under CWE-494 (Download of Code Without Integrity Check), poses severe risks in real-world attacks. Threat actors could leverage man-in-the-middle (MitM) techniques on unsecured networks to serve tampered installers, potentially deploying ransomware, malware droppers, or persistent backdoors.

While direct ties to ransomware campaigns remain unknown, the vulnerability’s simplicity, requiring no authentication or user interaction beyond routine updates, makes it ideal for supply chain-style compromises.

Notepad++’s prevalence on Windows endpoints amplifies exposure, especially in enterprise environments where manual updates are common.

Notepad++ developers have addressed the issue in version 8.8.9 and later, as detailed in their official clarification and community forum. The patch enforces cryptographic verification of update packages, thwarting interception attempts.

However, users on vulnerable versions (primarily 8.6 through 8.8.8) remain at risk if auto-updates are disabled—a common configuration for stability.

CISA urges immediate application of vendor patches, adherence to Binding Operational Directive (BOD) 22-01 for cloud-integrated services, or discontinuation of the product if mitigations are infeasible.

Organizations should scan endpoints for outdated Notepad++ installations using tools like Microsoft Defender or endpoint detection solutions, disable WinGUp temporarily, and enforce network segmentation to block MitM vectors.

Enable update notifications and verify downloads against official SHA-256 hashes from notepad-plus-plus.org.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.