CVE-2025-15556

Download of Code Without Integrity Check in Notepad++. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 12 February 2026.

Product: Notepad++
Added to CISA's catalog: 12 February 2026
Federal fix-by date: 5 March 2026
Ransomware: No known use in ransomware campaigns
Vendor advisories: notepad-plus-plus.org/news/clarification-security-incident/
community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
Sources: CISA’s catalog, NVD entry

CISA’s description.

Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.