Notepad++ Fixes Hijacked Update Mechanism Used to Deliver Targeted Malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-15556 | Unverified updates in Notepad++ WinGUp updater allow arbitrary code execution Notepad++ versions prior to 8.8.9, when using the bundled WinGUp updater, download update metadata and installers without cryptographically verifying their integrity (CWE-494). An attacker who can intercept or redirect the updater's network traffic, such as through a man-in-the-middle position or a DNS hijack, can substitute an attacker-controlled installer that the updater then downloads and executes. Successful exploitation yields arbitrary code execution with the privileges of the user running Notepad++, with no attacker credentials or privileges required. Any Windows installation of Notepad++ with the auto-updater in use is affected, and because Notepad++ is one of the most widely used free Windows text editors the potentially exposed population is very large, although practical attacks require control of the victim's update path. CISA added CVE-2025-15556 to the Known Exploited Vulnerabilities catalog on 2026-02-12, and public reporting indicates the hijacked update mechanism was used to deliver targeted malware, confirming exploitation in the wild. Do: Upgrade to Notepad++ 8.8.9 or later, which adds integrity verification of downloaded updates; this is also the required remediation for federal agencies under CISA BOD 22-01 following the 2026-02-12 KEV listing. Until patched, restrict or monitor hosts' access to the Notepad++ update endpoint and check whether WinGUp recently executed any unexpected installers on systems of interest. | 7.7 | 2% | KEV |
| masstens of millions of Windows installations (order-of-magnitude estimate) | |
| CVE-2026-25926 | Notepad++ is a free and open-source source code editor. Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue. NVD description · AI analysis pending | 7.3 | <1% | PoC |
| — |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | notepad-plus-plus.org | fication of the signed XML returned by the update server at notepad-plus-plus[.]org. In addition to these enhancements, security-focused chan |
Full article408 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 18, 2026Vulnerability / Application Security
Notepad++ has released a security fix to plug gaps that were exploited by an advanced threat actor from China to hijack the software update mechanism to selectively deliver malware to targets of interest.
The version 8.9.2 update incorporates what maintainer Don Ho calls a "double lock" design that aims to make the update process "robust and effectively unexploitable." This includes verification of the signed installer downloaded from GitHub (implemented in version 8.8.9 and later), as well as the newly added verification of the signed XML returned by the update server at notepad-plus-plus[.]org.
In addition to these enhancements, security-focused changes have been introduced to WinGUp, the auto-updater component -
- Removal of libcurl.dll to eliminate DLL side-loading risk
- Removal of two unsecured cURL SSL options: CURLSSLOPT_ALLOW_BEAST and CURLSSLOPT_NO_REVOKE
- Restriction of plugin management execution to programs signed with the same certificate as WinGUp
The update also addresses a high-severity vulnerability (CVE-2026-25926, CVSS score: 7.3) that could result in arbitrary code execution in the context of the running application.
"An Unsafe Search Path vulnerability (CWE-426) exists when launching Windows Explorer without an absolute executable path," Ho said. "This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application."
The development comes weeks after Notepad++ disclosed that a breach at the hosting provider level enabled threat actors to hijack update traffic starting June 2025 and redirect requests from certain users to malicious servers to serve a poisoned update. The issue was detected in early December 2025.
According to Rapid7 and Kaspersky, the tampered updates enabled the attackers to deliver a previously undocumented backdoor dubbed Chrysalis. The supply chain incident, tracked under the CVE identifier CVE-2025-15556 (CVSS score: 7.7), has been attributed to a China-nexus hacking group called Lotus Panda.
The attack is assessed to have targeted individuals and organizations located in Vietnam, El Salvador, Australia, the Philippines, the U.S., South America, and Europe, spanning cloud hosting, energy, financial, government, manufacturing, and software development sectors, per data from Kaspersky and Palo Alto Networks Unit 42.
Notepad++ users are recommended to update to version 8.9.2, and make sure that the installers are downloaded from the official domain.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/02/notepad-fixes-hijacked-update-mechanism.html