Notepad++ Downloaded the Update. It Never Checked Who Made It.
Notepad++ CVE-2025-15556 allowed the application to download an update without cryptographically proving who made it. Attackers exploited that gap to redirect the updater toward malicious installers.
The flaw affects Notepad++ versions before 8.8.9 that use the WinGUp updater. The updater did not verify update metadata and installers with a strong cryptographic signature before execution. An attacker able to intercept or redirect the update request could substitute a malicious package that ran with the user’s privileges.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 12 February 2026. Notepad++ said the official installers in its GitHub repository were not compromised. The failure sat in the delivery and verification chain, which is exactly why a clean origin repository did not protect users whose updater was redirected.
The update arrived, but trust was missing
| Question | Verified answer |
|---|---|
| What is the flaw? | CVE-2025-15556, insufficient cryptographic verification in the WinGUp update process |
| What versions are affected? | Notepad++ before version 8.8.9 |
| What can an attacker do? | Redirect update traffic and cause a malicious installer to execute with the current user’s privileges |
| Is exploitation confirmed? | Yes. CISA lists the vulnerability in KEV and the project published incident details about hijacked update traffic. |
| Were official GitHub installers modified? | Notepad++ says no. The repository packages were not the compromised component. |
| What strengthened the process? | Later releases added stronger signed-update validation, including XML digital-signature verification. |
TLS alone was not the final trust decision
Software update security needs an end-to-end answer. Transport encryption can protect a connection, but it does not help if the destination, response or hosting path is compromised and the client accepts whatever package arrives. The updater itself needs to verify that the release was signed by the expected publisher and that the metadata binding the version to the installer has not changed.
In this incident, the attacker’s opportunity was the gap between downloading a file and proving its publisher. The official project repository could remain intact while a user received a different file through a compromised or redirected path. That distinction matters for incident response because checking only the vendor’s current hashes does not establish what an endpoint executed earlier.
What defenders should do
- Upgrade Notepad++. Remove versions before 8.8.9 and prefer the latest supported release with the strengthened updater verification.
- Hunt for abnormal updater activity. Review DNS, proxy and endpoint records for WinGUp connections to unexpected domains, unusual redirects or installers launched from temporary locations.
- Validate installed binaries. Compare hashes and signatures against official releases, but remember that a clean current binary does not rule out earlier malicious execution.
- Review child processes. Investigate command shells, scripting engines, persistence changes and outbound connections that followed Notepad++ or updater execution.
- Control software distribution. Enterprises can reduce exposure by distributing approved packages through managed deployment systems instead of allowing every endpoint to update directly.
- Use KEV as an incident trigger. An exploited updater flaw warrants retrospective hunting, not only a future version upgrade.
The BlackTree view
Users clicked update because they were trying to become safer. The updater turned that trusted maintenance act into the delivery mechanism. That inversion is what makes software-update compromises disproportionately effective.
The defensive requirement is simple to state and easy to underbuild: the client must verify the publisher, the metadata and the package before execution. A secure download channel is useful, but it cannot substitute for a cryptographic decision at the endpoint.
Sources and publication details
- NVD entry for the Notepad++ updater vulnerability, accessed 1 September 2026.
- Notepad++: Hijacked incident information update, accessed 1 September 2026.
- Notepad++: Clarification of the security incident, accessed 1 September 2026.
- CISA Known Exploited Vulnerabilities Catalog, entry added 12 February 2026. The catalogue entry provides a date but no publication time.
