Patch Gap

Everyday apps · updated Oct 27, 2026

Notepad++: its old updater could be tricked into installing a fake update, and attackers did it

Patched: update nowBeing attacked nowHigh

Last checked · Check before installing; only use the official link.

Notepad++ is a free text editor for Windows. Its built-in updater did not check that an update really came from Notepad++. Attackers who took over the old hosting company sent fake updates to some chosen targets. Version 8.8.9 added the check, and the maker says to install 8.9.1 or newer.

Status
Patched: update now
Being attacked?
Yes[1]
Severity
High
Updated

Notepad++ says a state-backed group used it against selected organizations. CISA lists it as used in real attacks (added Feb 12, 2026). Severity: Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked). First reported .

Am I affected?

You are at risk if Notepad++ is older than 8.9.1. Most home users were not targeted, but you should still update.

AppDeviceAffectedFixed in
Notepad++WindowsNotepad++ before 8.8.9 (the maker recommends 8.9.1 or newer)8.9.1 (first fix in 8.8.9)[1][2]

How to check your version

These checks only look. They do not change anything on your computer.

Notepad++ on Windows

Easy way: Open Notepad++ > ? menu > About Notepad++.

Or type this in PowerShellRead-only. It only reads the version and changes nothing.

(Get-Item "$env:ProgramFiles\Notepad++\notepad++.exe").VersionInfo.ProductVersion

How to fix it

  1. Open notepad-plus-plus.org and click Download (type the address yourself).
  2. Download the newest installer and run it.
  3. You can turn off the auto-updater during install if you prefer.

More on each app: Is my Notepad++ up to date?

Official links

Check before installing, and only use these official links or the app's own update button.

For AI agents

This page as data: /incidents/notepad-plus-plus-updater-hijack-2026.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.

Tracking numbers (CVE): CVE-2025-15556

Sources

  1. MakerNotepad++: Important Clarification: Notepad++ Security Incident (Feb 5, 2026)
  2. MakerNotepad++ Community (official): Notepad++ v8.8.9 release notes (Dec 9, 2025)
  3. CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-15556 (added 2026-02-12) (Feb 12, 2026)
  4. NVDNVD: CVE-2025-15556 (Feb 12, 2026)

"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.