CVE-2025-15556: Notepad++ WinGUp updater lacks update integrity verification

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCISA KEV listing confirms known exploitation and the flaw yields code execution, though exploitation requires a network interception position and user update action.

What it is

Notepad++ versions prior to 8.8.9 use the WinGUp updater, which downloads update metadata and installers without cryptographic verification. An attacker who can intercept or redirect update traffic can substitute an attacker-controlled installer, and because the updater runs it, this becomes code execution on the user's machine. The flaw is a missing integrity check (CWE-494) rather than a memory-safety bug.

Impact

An attacker gains arbitrary code execution with the privileges of the user running Notepad++, which can lead to full compromise of that user's data and credentials. No privilege escalation beyond the user's own rights is described.

Attack surface

Reached over the network by intercepting or redirecting the updater's HTTP(S) traffic; no authentication is required, but the user must take an action (UI:P) such as triggering or accepting an update. The CVSS 4.0 vector is AV:N/AC:H/PR:N/UI:P, so exploitation depends on a man-in-the-middle position or control of the update path.

Exploitation

CVE-2025-15556 is listed in CISA KEV (added 2026-02-12, due 2026-03-05), indicating known exploitation, while EPSS is low at 0.0171 (76th percentile). References include vendor advisories and patch commits, and no ransomware campaign use is documented.

What to do

• Upgrade Notepad++ to 8.8.9 or later, which fixes the WinGUp integrity verification issue.
• If immediate upgrade is not possible, restrict or block the WinGUp updater's outbound update traffic and update manually from a trusted source.
• Ensure update traffic traverses only trusted, integrity-protected networks; treat plain or interceptable update channels as hostile.
• Apply the vendor's incident guidance and monitor for any unauthorized installer execution attributed to the updater.
• Track CISA KEV remediation deadlines (due 2026-03-05) and confirm affected endpoints are patched.

Detection

• Monitor for WinGUp updater processes spawning unexpected child processes or installers, especially outside normal update windows.
• Alert on Notepad++ update downloads from unexpected hosts, IPs, or non-standard URLs, and on TLS interception or redirect anomalies on update traffic.
• Review endpoint logs for installer execution originating from the updater's download path or temporary directories.
• Hunt for Notepad++ versions below 8.8.9 across managed endpoints to find unpatched installs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.