CVE-2025-15556 KEV
7.5
HIGH · CVSS 3.1 · EPSS 1.7% (pctl 77)
Patch first
On CISA KEV — known exploited in the wild, due 2026-03-05.
Description
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
Scoring
| CVSS | 7.5 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 1.75% — more likely to be exploited than 77% of all CVEs |
| Weakness | CWE-494 |
| On CISA KEV | yes — remediate by 2026-03-05 |
| Public exploit | none known |
| Published | 2026-02-03 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Notepad++ Download of Code Without Integrity Check Vulnerability |
|---|---|
| Added | 2026-02-12 |
| Due | 2026-03-05 |
| Vendor / product | Notepad++ / Notepad++ |
| Ransomware use | none reported |
Affected (1)
| Vendor | Product |
|---|---|
| notepad-plus-plus | notepad\+\+ |
References
- https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
- https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab
- https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb
- https://notepad-plus-plus.org/news/hijacked-incident-info-update/
- https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification
- https://notepad-plus-plus.org//news//clarification-security-incident/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556
→ the Explorer · watch your stack · NVD