CVE-2026-48800

What it actually does

This is a local command execution flaw in Notepad++ before version 8.9.6.1. Notepad++ reads the text inside the <Command> element under <UserDefinedCommands> in shortcuts.xml and stores it as a Run menu command without validating whether it points to a safe or expected executable. When a user later selects the corresponding Run menu item, Notepad++ passes the attacker-controlled value to ShellExecute, causing arbitrary local commands or executables to run with the privileges of the user running Notepad++. The flaw requires user interaction but does not require elevated privileges, and successful exploitation can lead to full compromise of the user context, including code execution, persistence, credential theft, data access, and further lateral movement depending on local permissions.

Why it matters to the business

An attacker who can modify a Notepad++ configuration file or deliver a malicious configuration package can turn a normal-looking Run menu entry into a hidden execution trigger. This can create a persistence mechanism that blends into a legitimate developer or administrator tool, allowing malware to execute when the user interacts with Notepad++. Organizations with broad Notepad++ deployment, especially on developer, IT, or administrative workstations, should treat this as a meaningful endpoint compromise risk even though it is not remotely exploitable by itself. The vulnerability is not currently listed in CISA KEV, is not identified as ransomware-used, and has low EPSS at the time of analysis, but the impact is high if an attacker already has file-write access to the user's Notepad++ configuration or can socially engineer import/use of a malicious configuration.

How an attack unfolds

An attacker first obtains a way to place or modify a Notepad++ shortcuts.xml file, such as through malware already running as the user, a malicious archive, a tampered portable Notepad++ package, abuse of a synced user profile, or social engineering that convinces a user to install a customized configuration. The attacker adds or changes a <UserDefinedCommands> entry so that its <Command> value points to an attacker-controlled executable, script interpreter, or command line. The entry appears to the user as a normal Run menu item. When the user opens Notepad++ and clicks that Run menu item, Notepad++ calls ShellExecute using the unvalidated command value. The payload then runs with the user's privileges. From there, the attacker can establish persistence, download additional tooling, access source code or documents, steal credentials available to the user, or pivot to other systems if the compromised user context has access.

How to fix it

Upgrade Notepad++ to version 8.9.6.1 or later on all managed endpoints and portable installations. Remove or quarantine older Notepad++ versions prior to 8.9.6.1, including copies distributed in developer tool bundles, software shares, golden images, and portable application directories. Where immediate upgrade is not possible, restrict write access to Notepad++ configuration files, monitor and control changes to shortcuts.xml, and remove untrusted or unnecessary Run menu user-defined commands. Consider application control policies that prevent Notepad++ from launching high-risk child processes such as command shells, script interpreters, LOLBins, and download utilities unless explicitly required.

How to confirm the fix worked

Confirm the installed Notepad++ version is 8.9.6.1 or later. Inventory both installed and portable copies, because portable Notepad++ instances may not appear in standard software inventory. Inspect user and portable Notepad++ shortcuts.xml files for <UserDefinedCommands> entries containing suspicious commands, script interpreters, download commands, encoded PowerShell, temporary-directory payloads, UNC paths, or unusual executable paths. Validate that Notepad++ can no longer be used to execute an arbitrary injected Run menu command after upgrade. Review endpoint telemetry to confirm notepad++.exe is not spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl.exe, or renamed binaries from user-writable directories.

Typical attack path

1. Gain the ability to write to or replace a Notepad++ shortcuts.xml configuration file for a user or portable Notepad++ installation.
2. Insert a malicious <Command> value under <UserDefinedCommands> while giving the menu entry a benign-looking name.
3. Wait for the user to open Notepad++ and select the corresponding item from the Run menu.
4. Notepad++ invokes ShellExecute with the attacker-controlled command string.
5. The attacker-controlled executable, script, or shell command runs under the current user's privileges.
6. The attacker uses the execution opportunity for persistence, payload staging, credential theft, data access, or lateral movement.

How to detect it

To determine whether this was already exploited, review endpoint process creation logs, EDR telemetry, Sysmon Event ID 1, Windows Security Event ID 4688 if command-line auditing is enabled, and any application control logs for suspicious child processes launched by notepad++.exe. Focus on notepad++.exe spawning command shells, script interpreters, living-off-the-land binaries, download tools, or executables from temporary, downloads, desktop, profile, network share, or portable application directories. Review file creation and modification telemetry, EDR file events, Sysmon Event ID 11, and backup/file integrity data for changes to shortcuts.xml in Notepad++ configuration locations. Inspect the XML content for recently added <UserDefinedCommands> and <Command> elements containing encoded commands, URLs, UNC paths, PowerShell flags, script extensions, or references to user-writable paths. If suspicious entries are found, correlate the modification timestamp with logon activity, archive extraction, software installation, Notepad++ launches, Run menu use, and downstream child process execution. Also examine persistence artifacts, downloaded payloads, browser/download history, and EDR detections around the time notepad++.exe executed the suspicious child process.

• %APPDATA%\Notepad++\shortcuts.xml
• shortcuts.xml
• <UserDefinedCommands>
• </UserDefinedCommands>
• <Command>powershell.exe
• <Command>pwsh.exe
• <Command>cmd.exe
• <Command>wscript.exe
• <Command>cscript.exe
• <Command>mshta.exe
• <Command>rundll32.exe
• <Command>regsvr32.exe
• <Command>certutil.exe
• <Command>curl.exe
• <Command>wget.exe
• <Command>bitsadmin.exe
• <Command>\\
• <Command>http://
• <Command>https://
• powershell.exe -enc
• powershell.exe -EncodedCommand
• powershell.exe -nop
• powershell.exe -NoProfile
• notepad++.exe -> cmd.exe
• notepad++.exe -> powershell.exe
• notepad++.exe -> pwsh.exe
• notepad++.exe -> wscript.exe
• notepad++.exe -> cscript.exe
• notepad++.exe -> mshta.exe
• notepad++.exe -> rundll32.exe
• notepad++.exe -> regsvr32.exe
• notepad++.exe -> certutil.exe
• notepad++.exe -> curl.exe
• ParentImage: *\notepad++.exe Image: *\cmd.exe
• ParentImage: *\notepad++.exe Image: *\powershell.exe
• ParentImage: *\notepad++.exe Image: *\pwsh.exe
• ParentImage: *\notepad++.exe Image: *\wscript.exe
• ParentImage: *\notepad++.exe Image: *\cscript.exe
• ParentImage: *\notepad++.exe Image: *\mshta.exe
• ParentImage: *\notepad++.exe Image: *\rundll32.exe
• ParentImage: *\notepad++.exe Image: *\regsvr32.exe
• ParentImage: *\notepad++.exe Image: *\certutil.exe

What your security team should do

• Prioritize upgrading all Notepad++ installations to 8.9.6.1 or later, including portable and bundled copies.
• Search endpoint telemetry for notepad++.exe spawning shells, script interpreters, download utilities, or binaries from user-writable paths.
• Hunt for recent modifications to Notepad++ shortcuts.xml files, especially where the change introduced or altered <UserDefinedCommands> entries.
• Inspect developer and administrator workstations first because successful exploitation there may expose source code, credentials, signing material, deployment secrets, or privileged access paths.
• Use application control or EDR prevention rules to alert on or block unusual child processes launched by notepad++.exe.
• Remove unneeded user-defined Run commands from Notepad++ configurations and ensure configuration files are not writable by unauthorized users or distributed from untrusted packages.
• Educate users not to import or run untrusted Notepad++ configuration bundles, plugins, or portable application packages.