CVE-2025-15556Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.

7.7 HIGHEPSS 1.74%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 08:38 UTC

OverviewCVSS details

7.7HIGHCVSS 4.0

Score source: VulnCheck (CNA)
NVD status: Analyzed
Published: Feb 3, 2026
Assigner: VulnCheck

Affected

notepad-plus-plus (notepad-plus-plus)

Versions: before 8.8.9
Fixed in: 8.8.9

Exploitation

Public exploit: None listed
CISA KEV: Listed · Feb 12, 2026
KEV due date: Mar 5, 2026
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact total

EPSS · FIRST, scored Nov 8

1.74%chance of exploitation in 30 days

Higher than 77.95% of CVEs

CVSS 4.0 · VulnCheck (CNA)

7.7High

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: None
Privileges required: None
User interaction: Passive
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

7.5High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.7	HIGH	4.0VulnCheck (CNA)	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.5	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Mar 5, 2026

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2025-15556
Status: Analyzed
Assigner (CNA): VulnCheck
Published: Feb 3, 2026
Last modified: 2026-06-17 08:38 UTC
Weaknesses: CWE-494 · Download of Code Without Integrity Check

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 11:16 UTC.