{"id":"CVE-2025-15556","published":"2026-02-03T01:15:57Z","modified":"2026-06-17T08:38:01Z","title":"Notepad++ Download of Code Without Integrity Check Vulnerability","vendor":"Notepad++","product":"Notepad++","tier":"core","eol":null,"description":{"text":"Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.","provenance":"source","from":"NVD"},"summary":{"text":"Notepad++ versions prior to 8.8.9 contain a flaw in the WinGUp updater, which does not cryptographically verify downloaded update metadata and installers. An attacker who can intercept or redirect update traffic can get the updater to download and run a malicious installer, achieving arbitrary code execution with the user's privileges, though this requires the attacker to control the update traffic path and the user to trigger or accept the update.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:33Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01746,"percentile":0.77785,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-02-12","dueDate":"2026-03-05","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://notepad-plus-plus.org/news/clarification-security-incident/ ; https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix ; https://nvd.nist.gov/vuln/detail/CVE-2025-15556","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-02-02","exploitedFirstSeen":"2026-02-02","ransomware":false,"evidence":[{"url":"https://notepad-plus-plus.org/news/hijacked-incident-info-update/","date":"2026-02-02"},{"url":"https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/","date":"2026-02-02"},{"url":"https://securelist.com/notepad-supply-chain-attack/118708/","date":"2026-02-03"},{"url":"https://www.cve.org/cverecord?id=CVE-2025-15556","date":"2026-02-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-02-12"},{"url":"https://www.recordedfuture.com/blog/february-2026-cve-landscape","date":"2026-03-12"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-494","name":"Download of Code Without Integrity Check"}],"references":[{"url":"https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix","tags":["Release Notes"]},{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab","tags":["Patch"]},{"url":"https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb","tags":["Patch"]},{"url":"https://notepad-plus-plus.org/news/hijacked-incident-info-update/","tags":["Patch","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification","tags":["Third Party Advisory"]},{"url":"https://notepad-plus-plus.org//news//clarification-security-incident/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556","tags":["US Government Resource"]}],"techniques":[{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Intercepting update traffic enables the initial compromise path","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An attacker able to intercept or redirect update traffic","start":205,"end":261}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Updater executes attacker-supplied installer, user-context execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"cause the updater to download and execute an attacker-controlled installer","start":266,"end":340}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-206661","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206661","exploited":true,"exploitedSince":"2026-02-12","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2026-02-09","earliestUrl":"https://github.com/renat0z3r0/notepadpp-supply-chain-iocs","repos":[{"name":"renat0z3r0/notepadpp-supply-chain-iocs","url":"https://github.com/renat0z3r0/notepadpp-supply-chain-iocs","stars":1,"created":"2026-02-09"},{"name":"George0Papasotiriou/CVE-2025-15556-Notepad-WinGUp-Updater-RCE","url":"https://github.com/George0Papasotiriou/CVE-2025-15556-Notepad-WinGUp-Updater-RCE","stars":1,"created":"2026-02-10"}]},"first":{"date":"2026-02-09","source":"PoC-in-GitHub","url":"https://github.com/renat0z3r0/notepadpp-supply-chain-iocs"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1557"],"provenance":"ai"},{"stage":"primary","techniques":["T1204.002"],"provenance":"ai"}],"timeline":[{"date":"2026-02-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://notepad-plus-plus.org/news/hijacked-incident-info-update/","provenance":"source"},{"date":"2026-02-03","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15556","provenance":"source"},{"date":"2026-02-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/renat0z3r0/notepadpp-supply-chain-iocs","provenance":"source"},{"date":"2026-02-12","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-02-12","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206661","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":9},"priority":{"score":68.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 271 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.56,"detail":"percentile 0.7779"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}