CVE-2025-15556 HIGH

CVE-2025-15556: Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

Vendor Notepad-Plus-Plus
Product notepad-plus-plus
Weakness CWE-494 · Download without integrity check
KEV Status Known Exploited
Published February 3, 2026
Last update March 5, 2026
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.

CISA mandated remediation

02CISA Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Key dates

03Disclosure timeline

February 3, 2026 CVE published
March 5, 2026 Record updated