CISA Warns of Notepad++ Code Execution Vulnerability Exploited in Attacks
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
CISA has added CVE-2025-15556 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting active exploitation of a critical code execution flaw in Notepad++, a widely used open-source text editor popular among developers and IT professionals.<\/p>\n
Added on February 12, 2026, with a federal civilian executive branch (FCEB) patching deadline of March 5, 2026, the vulnerability stems from the WinGUp updater\u2019s failure to perform integrity checks on downloaded code.<\/p>\n
Attackers can intercept or redirect update traffic, tricking users into installing malicious payloads that execute arbitrary code with user-level privileges.<\/p>\n
This flaw, classified under CWE-494 (Download of Code Without Integrity Check), poses severe risks in real-world attacks. Threat actors could leverage man-in-the-middle (MitM) techniques<\/a> on unsecured networks to serve tampered installers, potentially deploying ransomware, malware droppers, or persistent backdoors.<\/p>\n While direct ties to ransomware campaigns remain unknown, the vulnerability\u2019s simplicity, requiring no authentication or user interaction beyond routine updates, makes it ideal for supply chain-style compromises.<\/p>\n Notepad++\u2019s prevalence on Windows endpoints amplifies exposure, especially in enterprise environments where manual updates are common.<\/p>\n