CVE-2025-15556

What it actually does

Notepad++ versions before 8.8.9 use the WinGUp updater in a way that does not cryptographically authenticate update metadata and downloaded installer content before execution. If an attacker can intercept, tamper with, or redirect update traffic, they can substitute malicious update information and cause the updater to retrieve and run an attacker-controlled installer. Successful exploitation results in arbitrary code execution with the privileges of the user running the update process. The attack requires user interaction to initiate or accept the update flow and requires the attacker to be positioned to manipulate update delivery, such as through a compromised network path, malicious proxy, DNS manipulation, captive portal, or poisoned update mirror/redirect.

Why it matters to the business

Compromise of developer, administrator, or power-user workstations can lead to credential theft, malware deployment, source-code or document theft, persistence, and lateral movement. Because Notepad++ is widely used on Windows endpoints, exposure may be broad even though exploitation requires both user interaction and a traffic-manipulation position. This issue is listed in CISA KEV with a remediation due date of 2026-03-05 and active exploitation has been reported, so organizations should treat vulnerable installations as an urgent endpoint software supply-chain risk despite the relatively low EPSS score.

How an attack unfolds

An attacker first gains the ability to influence the victim's update traffic, for example by controlling a local network, rogue Wi-Fi access point, proxy, DNS response, gateway, or other redirect point between the workstation and the update service. When a user runs Notepad++ and invokes the WinGUp update mechanism, the updater retrieves update metadata and an installer. In vulnerable versions, the updater does not adequately verify that the metadata and installer are authentic and signed by the expected publisher before execution. The attacker supplies modified metadata pointing to a malicious installer or substitutes the installer during download. The updater then launches the attacker-controlled payload in the user's context. The payload may install malware, establish persistence, harvest credentials, or stage additional tools. Known exploitation is tracked under the public KEV entry for a Notepad++ download-of-code-without-integrity-check vulnerability; defenders should focus on evidence of unusual updater network destinations, unexpected installers launched by the updater, and suspicious child processes following an update event.

How to fix it

Upgrade Notepad++ to version 8.8.9 or later on all Windows endpoints. For source-based deployments, ensure builds include the fixed upstream commit b5ce090bff42e6761f168592a6193eb591b8d021 or a later commit containing the integrity-verification fix. Remove or replace older bundled WinGUp updater components where software packaging leaves stale updater binaries behind. Where immediate upgrade is not possible, disable the Notepad++ updater, block updater execution through endpoint controls, restrict outbound updater traffic to approved destinations through authenticated TLS-inspecting controls where appropriate, and prevent users from installing updates from untrusted networks. Mitigations should be treated as temporary because the durable fix is to deploy a version that cryptographically verifies update content before execution.

How to confirm the fix worked

Confirm installed Notepad++ versions are 8.8.9 or later through software inventory, endpoint management, registry/application inventory, or by checking the application About dialog. Validate that the updater component present on disk corresponds to the patched release and that no older WinGUp binaries remain in application directories. For source or internally packaged builds, verify the codebase includes commit b5ce090bff42e6761f168592a6193eb591b8d021 or later. Test the update path in a controlled environment and confirm update metadata and installers are rejected if modified, unsigned, or served from an unexpected location. Review egress controls to ensure update traffic is not allowed to arbitrary destinations and that endpoint telemetry captures updater process creation and child-process execution.

Typical attack path

1. Identify systems running Notepad++ versions prior to 8.8.9 that still use the vulnerable WinGUp updater flow.
2. Obtain a position that can intercept or redirect the target's update traffic, such as DNS, proxy, gateway, rogue Wi-Fi, or compromised network infrastructure.
3. Wait for or induce the user to initiate a Notepad++ update check or update installation.
4. Tamper with update metadata or redirect the updater to an attacker-controlled installer.
5. Allow the vulnerable updater to download and execute the substituted installer without strong cryptographic verification.
6. Run code as the current user and use that foothold for persistence, credential access, data theft, or lateral movement.

How to detect it

To determine whether exploitation already occurred, correlate endpoint process telemetry, Windows event logs, EDR data, DNS logs, proxy logs, firewall logs, and software inventory. Focus on systems that ran Notepad++ versions prior to 8.8.9 and had updater activity after publication, especially on untrusted networks or through unusual proxies. Look for the WinGUp updater launching an installer from temporary, downloads, or user-writable directories; updater network traffic to destinations other than expected Notepad++ update infrastructure; DNS responses or proxy redirects for update-related traffic; and child processes inconsistent with a normal software update, such as command shells, PowerShell, script interpreters, credential tools, remote-access tools, or persistence utilities. On Windows, review Security 4688 process creation events, Sysmon Event ID 1 process creation, Sysmon Event ID 3 network connections, Sysmon Event ID 11 file creation, PowerShell operational logs, installer logs, and EDR process trees. Examine file creation timestamps around updater execution for unknown EXE/MSI files, recently created services, scheduled tasks, Run/RunOnce registry entries, startup-folder items, and new outbound persistence traffic. Because exploitation substitutes attacker-controlled content, there may be no universal hash IOC; behavioral correlation around updater execution is more reliable.

• \Notepad++\updater\gup.exe
• gup.exe
• WinGUp
• gup.exe spawning cmd.exe
• gup.exe spawning powershell.exe
• gup.exe spawning pwsh.exe
• gup.exe spawning wscript.exe
• gup.exe spawning cscript.exe
• gup.exe spawning mshta.exe
• gup.exe spawning rundll32.exe
• gup.exe spawning regsvr32.exe
• gup.exe spawning schtasks.exe
• gup.exe spawning certutil.exe
• gup.exe spawning bitsadmin.exe
• gup.exe spawning curl.exe
• gup.exe spawning wget.exe
• gup.exe spawning msiexec.exe
• %ProgramFiles%\Notepad++\updater\gup.exe
• %ProgramFiles(x86)%\Notepad++\updater\gup.exe
• C:\Program Files\Notepad++\updater\gup.exe
• C:\Program Files (x86)\Notepad++\updater\gup.exe
• notepad-plus-plus.org
• nppInstaller
• nppInstaller.x64.exe
• nppInstaller.exe

What your security team should do

• Prioritize enterprise-wide upgrade of Notepad++ to 8.8.9 or later before the CISA KEV due date of 2026-03-05, with accelerated handling for developer, administrator, helpdesk, and privileged-user workstations.
• Run software inventory queries to identify Notepad++ versions prior to 8.8.9 and any standalone or bundled WinGUp updater components.
• Hunt for recent executions of the Notepad++ updater that spawned unexpected installers, scripts, shells, archive tools, LOLBins, or network utilities.
• Review DNS, proxy, firewall, EDR, and process telemetry for Notepad++ updater traffic to unusual domains, IP addresses, or nonstandard update locations.
• Temporarily disable or block vulnerable updater execution where upgrades cannot be completed immediately.
• Educate users not to perform application updates while on untrusted networks such as public Wi-Fi until the patched version is installed.
• Add endpoint detection rules for updater-launched processes and unexpected installer execution from user-writable or temporary directories.
• Investigate any endpoint where a vulnerable updater executed shortly before suspicious process creation, persistence changes, credential-access alerts, or outbound connections.