Notepad++ updater flaw CVE-2025-15556 used to deliver malware; fixes released
Attackers hijacked Notepad++ updates to infect selected Windows users. Version 8.8.9 fixed installer verification; 8.9.2 added signed update-instruction checks. Install the current release manually and ask IT to investigate potentially affected work PCs.
Download the current Windows installer directly from the official Notepad++ website and install it manually. Version 8.8.9 fixes this CVE, while 8.9.2 adds further protection for update instructions. If a work computer used the updater between June and 2 December 2025, ask its IT team to check for compromise rather than relying on the update alone.
- Notepad++fixed in 8.8.9 and later
What’s happening
Attackers compromised Notepad++’s former hosting infrastructure and redirected selected Windows users’ update requests to malicious downloads. The WinGUp updater’s insufficient verification, tracked as CVE-2025-15556, allowed an attacker-controlled installer to run with the user’s permissions. Notepad++ dates the compromise from June to 2 December 2025, although investigators placed the last observed attack on 10 November. The vendor says targeting focused on high-value organisations and most users were unaffected. Researchers subsequently identified malware providing persistent remote access and a broader geographical spread of victims. Version 8.8.9, released on 9 December, added installer signature and certificate checks. Version 8.9.2, released on 16 February 2026, also checks signed update instructions. The hosting incident is resolved according to Notepad++, and fixes are available. CISA confirmed exploitation on 12 February. Updating protects the update process; potentially infected computers still need investigation.
- What
- Flaw
- Affects
- Notepad++ for Windows and its WinGUp updater
- Affected
- Notepad++ versions before 8.8.9 using the WinGUp updater
- Fixed in
- Notepad++ 8.8.9: downloaded-installer signature and certificate verification
Notepad++ 8.9.2: additional verification of signed update instructions - Since
- 12 Feb 2026
- Closed
- 16 Feb 2026
Timeline
- New fixFixed
Notepad++ released 8.9.2, adding verification of signed update instructions alongside the installer checks introduced in 8.8.9. The vendor said these protections fully addressed the update-hijacking weakness.
- CISA added
CISA added CVE-2025-15556 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.
- Update
Unit 42 reported previously unreported campaign infrastructure and evidence affecting organisations in South America, the US, Europe and Southeast Asia. Its findings included malware providing persistent remote access.
- Vendor revised
Notepad++ said the incident was resolved and most users had never been affected. It published further guidance and directed organisations to check investigation findings for signs of compromise.
- Vendor revised
Notepad++ traced the incident to its former hosting provider and confirmed that selected users received malicious update instructions. It had moved its website to another provider and recommended manually installing 8.9.1.
- Made publicFixed
Notepad++ disclosed malicious update redirections and released 8.8.9. Its updater checks downloaded installers’ signatures and certificates and stops installation if verification fails.
- Update
The former hosting provider completed remediation and revoked attackers’ remaining access, according to Notepad++’s later statement. The compromise began in June 2025; researchers placed the last observed attack on 10 November, while the provider reported potential access until 2 December.
Sources
- Notepad++ v8.8.9 release: Vulnerability-fixNotepad++ · 9 Dec 2025
- Notepad++ Hijacked by State-Sponsored HackersNotepad++ · 2 Feb 2026
- Important Clarification: Notepad++ Security IncidentNotepad++ · 5 Feb 2026
- Notepad++ v8.9.2 release - Double-Lock Update SecurityNotepad++ · 16 Feb 2026
- Notepad++ update feature hijacked by Chinese state hackers for monthsBleepingComputer · 2 Feb 2026
- Nation-State Actors Exploit Notepad++ Supply ChainPalo Alto Networks Unit 42 · 11 Feb 2026
- CISA Adds Four Known Exploited Vulnerabilities to CatalogCISA · 12 Feb 2026