Is CVE-2025-15556 (Notepad++ Download of Code Without Integrity Check) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-15556 to its Known Exploited Vulnerabilities catalogue on 12 February 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer.

How the exploitation status of CVE-2025-15556 is established

For a CVE like this, “being exploited in the wild” is not a theoretical assessment, it is an operational one. The strongest signal is inclusion in CISA’s Known Exploited Vulnerabilities catalogue, which is intended for vulnerabilities with reliable evidence of active exploitation, not just proof-of-concept interest or lab reproduction. For independent verification, compare the CVE record in the CVE Program and the listing in the CISA Known Exploited Vulnerabilities Catalog.

The practical question is whether your environment still exposes the updater path that makes the flaw usable. If Notepad++ with WinGUp is present, treat that as a live exposure until you have confirmed the version and update path in use, then validate whether enterprise controls, package management or local hardening change the way updates are fetched and executed.

Where a vulnerability affects code download and execution, the exploit condition usually sits in the trust boundary around update delivery rather than inside the application itself. That means the attacker does not need deep application access if they can interfere with retrieval, redirect traffic, or substitute the installer stream before integrity is checked.

What this means for patching and containment

When a vulnerability is on the KEV list, the operational priority is to remove the exposed condition quickly rather than wait for a broad maintenance cycle. The vendor advisory should drive the exact fixed build or mitigation path, while KEV status should drive urgency, exception handling and executive visibility. The NIST National Vulnerability Database remains useful for record consolidation, but it should not replace vendor guidance for version-specific remediation.

If patching must wait, reduce the chance that an update request can be altered in transit. That means tightening egress paths, proxy behavior and DNS trust, and ensuring update traffic is not being intercepted, redirected or downgraded by local controls. If the updater is externally reachable through a shared network path, that path deserves the same scrutiny as any other software delivery channel.

This is also the point to check for earlier compromise, because an exploited update path can convert a routine installer into an execution vector. Review process creation, installer telemetry, proxy logs and endpoint detections for unexpected updater launches, suspicious child processes, unusual download destinations or installer provenance that does not match your standard update flow.

Why integrity failures in updater traffic matter

A download-without-integrity-check issue is dangerous because it undermines the assumption that an update is trustworthy once it is fetched. In practice, that can turn a normal maintenance task into remote code execution if an attacker can influence transport or content delivery, especially on systems where users routinely trust the updater without additional scrutiny.

Organizations often underestimate how much update trust depends on network conditions, local trust stores and user behaviour. If a threat actor can steer a machine toward a malicious installer, the endpoint may willingly help complete the compromise by executing the payload with the user’s privileges, and sometimes with higher privileges if the update is performed in an elevated context.

Once that trust boundary is broken, the exposure is broader than a single host. Compromised workstations can become footholds for credential theft, lateral movement and follow-on malware, especially where the same device is used for admin work or has cached access to internal services.

Risk and Threat Considerations

Code-download flaws in update mechanisms are attractive to attackers because they sit on a high-trust path that users and administrators expect to be safe. If an adversary can intercept or redirect the update request, they can deliver a malicious installer that looks like routine maintenance, which is a low-noise way to gain execution on targeted systems.

Failure mechanism: The updater retrieves executable content without a sufficient integrity safeguard, so network interception, content substitution or redirection can replace the legitimate installer with attacker-controlled code.

Impact: The result can be arbitrary code execution, endpoint compromise and subsequent access to stored sessions, credentials or internal resources that the affected machine can reach.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires rapid exposure tracking and remediation prioritization.
Recommendation — Prioritize and remediate KEV-listed software exposures on an accelerated SLA.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires timely remediation and validation after patching or mitigation.
	CM-8 — System Component Inventory	Confirming exposure depends on knowing where Notepad++ and WinGUp are deployed.
	SC-7 — Boundary Protection	The exploit path depends on controlling traffic that can be intercepted or redirected.
Recommendation — Apply SI-2 to track, patch, and verify remediation of the vulnerable updater path. Maintain accurate inventories so you can find and remove the exposed updater quickly. Use SC-7 to restrict and inspect update traffic paths that could be manipulated in transit.
OWASP ASVS	V11 — Cryptography	The issue centers on trust in downloaded code and integrity verification of executable content.
	V15 — Secure Coding and Architecture	Updater trust boundaries and secure distribution design are central to preventing this flaw.
Recommendation — Require integrity verification for downloaded executables before they are run. Design update mechanisms so executable delivery cannot be replaced or redirected without detection.

Practitioner Guidance

What to verify: Confirm whether any fleet segment still uses Notepad++ with WinGUp, then verify the update path, proxy path and whether the control plane can enforce trusted distribution rather than user-driven retrieval. If the application is installed broadly, treat the updater as an enterprise software-delivery dependency, not a desktop convenience feature.

Decision rule: If the vulnerable update path cannot be rapidly removed, isolate the affected hosts from untrusted network interception points and prioritise compromise hunting before you spend time proving exploitation one host at a time.

Practitioner takeaway: For in-the-wild exploitation, the important judgement is not whether the flaw is “serious in theory”, it is whether the update channel can still be trusted; if it cannot, assume the path is already an execution surface and respond accordingly.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org