CVE-2025-15556

HIGH CISA KEV EPSS 66.1%
Published Feb 3, 20264mo ago · Modified Jun 17, 20261w ago
7.7 CVSS 4.0
High
Find Similar
Published Feb 3, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago
KEV Listed Feb 12, 2026 4mo ago
KEV Due Mar 5, 2026 118d overdue

Description

Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.

CVSS Details

Base Score
7.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

CISA Known Exploited Overdue 118d
Added
Feb 12, 2026
Due
Mar 5, 2026

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
66.1% percentile
Exploit & Patch Status
Actively Exploited (KEV)
Patch Available

Weaknesses 1

CWE-494

Affected Products 1

VendorProductVersionRange
notepad-plus-plusnotepad\+\+* <8.8.9

References 7

  • community.notepad-plus-plus.org https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
    Release Notes
  • github.com https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab
    Patch
  • github.com https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb
    Patch
  • notepad-plus-plus.org https://notepad-plus-plus.org//news//clarification-security-incident/
    Vendor Advisory
  • notepad-plus-plus.org https://notepad-plus-plus.org/news/hijacked-incident-info-update/
    PatchVendor Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556
    US Government Resource
  • vulncheck.com https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification
    Third Party Advisory

Remediation

  • github.com https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab
    Patch
  • github.com https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb
    Patch
  • notepad-plus-plus.org https://notepad-plus-plus.org/news/hijacked-incident-info-update/
    PatchVendor Advisory