PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46710 notepad-plus-plus CVE debrief

Notepad++ versions 8.9.4 through 8.9.6 contain a local privilege escalation vulnerability. The installer invokes powershell.exe without using an absolute path after setting the working directory to the installation contextMenu directory. If an attacker can pre-place a malicious powershell.exe in a user-writable custom installation directory, and a privileged user later runs the installer and selects that directory, the attacker-controlled executable is launched with the elevated privileges of the installer. This vulnerability is fixed in version 8.9.6. Users should update to the latest version to mitigate this vulnerability. Additionally, users should be cautious when selecting installation directories and ensure that the directory is secure.

Vendor
notepad-plus-plus
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-29
Advisory published
2026-06-26
Advisory updated
2026-06-29

Who should care

Users of Notepad++ versions 8.9.4 through 8.9.6 should be aware of this vulnerability and take steps to mitigate it. System administrators and security teams should also be aware of this vulnerability and ensure that Notepad++ is updated to the latest version. Furthermore, users should be cautious when selecting installation directories and ensure that the directory is secure.

Technical summary

The vulnerability exists in the Notepad++ installer, which invokes powershell.exe without using an absolute path after setting the working directory to the installation contextMenu directory. This allows an attacker to pre-place a malicious powershell.exe in a user-writable custom installation directory. When a privileged user runs the installer and selects that directory, the attacker-controlled executable is launched with the elevated privileges of the installer. The vulnerability is due to the insecure way the installer handles the powershell.exe invocation. The vulnerability can be exploited by an attacker with local access to the system.

Defensive priority

High

Recommended defensive actions

  • Update Notepad++ to version 8.9.6 or later
  • Be cautious when selecting installation directories and ensure that the directory is secure
  • Monitor system logs for suspicious activity
  • Implement additional security controls to prevent local privilege escalation
  • Conduct regular vulnerability assessments and penetration testing

Evidence notes

The vulnerability was reported by an unknown source and is tracked by CVE-2026-46710. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The vulnerability affects Notepad++ versions 8.9.4 through 8.9.6.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46710 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46710

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46710 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46710

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.