Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification (CVE-2025-15556)

What is affected, what to do

Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.

The vulnerability is being actively exploited; treat it as a priority. Update Notepad++ Project Notepad-plus-plus to version 8.8.9. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Notepad++ Project Notepad-plus-plus lt *..8.8.9

Fixed in

• Notepad++ Project Notepad-plus-plus 8.8.9

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every endpoint running Notepad++ below 8.8.9 via EDR, SCCM/Intune or software inventory. Include portable copies in user profiles (notepad++.exe outside C:\Program Files*), which central deployment tooling usually misses.
   • Push the patch centrally: Deploy Notepad++ 8.8.9 or later through your software distribution tooling, not the built-in updater. Fetch the installer from the official source, verify its signature and hash against the vendor-published values, and pin that hash in the package.
   • Kill the built-in updater: Until rollout completes, block the WinGUp updater (updater\GUP.exe in the install directory) with an AppLocker/WDAC rule, or remove the directory via script. Also turn off the automatic update check in preferences.
   • Compromise assessment: Hunt EDR and Sysmon history going back several months for child processes of GUP.exe, such as unknown installers, script interpreters or LOLBins. On any hit, isolate the host and invoke your incident-handling process.
   • Prioritise high-value users: Patch admins, developers and OT engineering workstations first. Notepad++ often runs on those machines next to privileged credentials or with elevated rights.
2. 02

   Runbook step 2

   Mitigation layers

   • Deployment / configuration: Ship Notepad++ only as a managed package (Intune, SCCM, winget with a private source) and permanently disable self-update. IT owns the update path, not the end user.
   • Endpoint hardening (application control): Use WDAC/AppLocker to block execution of unsigned or non-vendor-signed binaries from %TEMP%, %LOCALAPPDATA%\Temp and download folders. These are the usual landing zones for downloaded update installers.
   • Network / proxy: Allow GUP.exe egress only through the authenticated corporate proxy and block direct internet access. With TLS inspection in place, block or alert on executable downloads whose destination is not the official Notepad++ domains or the project's GitHub release repository.
   • DNS integrity: Enforce internal resolvers and block client-side DoH/DoT. Use always-on VPN for remote staff on hotel, conference or untrusted Wi-Fi. Intercepted or redirected update traffic is the core attack vector.
   • IAM / least privilege: Never run Notepad++ elevated. Strip local admin rights from standard users so a rogue installer is confined to the user context.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 / EDR process tree: Parent GUP.exe spawning anything other than the signed Notepad++ installer, especially cmd.exe, powershell.exe, rundll32.exe or mshta.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "GUP.exe" | where not(ProcessVersionInfoCompanyName has "Notepad++")
   • Sysmon EID 3 / EID 22 (network, DNS): GUP.exe connecting to destinations outside the project domains or GitHub, to raw IPs, or to newly registered domains. SPL: index=sysmon EventCode=3 Image="*\\GUP.exe" | stats count by DestinationIp, DestinationHostname
   • Sysmon EID 11 (file create): GUP.exe writing .exe or .msi files to temp folders that then execute without a valid vendor signature. Correlate with Sysmon EID 7 Authenticode status or the EDR signer field.
   • Proxy / Zeek logs: Plain-HTTP downloads, or TLS sessions with unexpected certificates, originating from the updater's process context. In Zeek files.log, look for PE files delivered right after Notepad++ update-check requests.
   • Follow-on activity: New Run keys (Sysmon EID 13), scheduled tasks (Security 4698) or services (System 7045) within 10 minutes of a GUP.exe child process. Sigma skeleton: selection: ParentImage|endswith: '\GUP.exe' time-correlated with persistence events.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Notepad++ Notepad\+\+
• Notepad++ Notepad-plus-plus

Weakness classes (CWE)

• CWE-494Download of Code Without Integrity Check

  Base

  The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

  Entry at MITRE CWE-494

References & sources

• community.notepad-plus-plus.orgtopic/27298/notepad-v8-8-9-vulnerability-fixRelease notes, Patch, Release notes
• notepad-plus-plus.orgnews/hijacked-incident-info-updateVendor advisory, Patch, Vendor advisory
• github.comnotepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717…Patch, Patch
• github.comnotepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3…Patch, Patch
• vulncheck.comadvisories/notepad-plus-plus-wingup-updater-lacks-update-integr…Third-party advisory, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556government-resource, US government resource
• notepad-plus-plus.orgnews//clarification-security-incidentThird-party advisory, Vendor advisory