CVE-2026-77605 notepad-plus-plus CVE debrief

Who should care

Defenders and users of Notepad++ should be aware of this vulnerability and take necessary precautions to mitigate it. This includes updating to version 8.9.8 or later and exercising caution when using the 'Run by system' action on text files.

Why it matters

This vulnerability in Notepad++ can lead to the execution of command scripts when a user interacts with a maliciously crafted file. Defenders should prioritize updating Notepad++ and monitoring user interactions to mitigate this risk.

• Potential execution of arbitrary command scripts
• Elevation of privileges through user interaction
• Possible lateral movement within a compromised network
• Need for verification of Notepad++ version and user interactions

Technical summary

The Folder as Workspace 'Run by system' action in Notepad++ can resolve a different sibling file than the file selected by the user. An attacker can place a command script whose name is the selected text-file path with '.cmd' appended, and the user invokes 'Run by system' on the text file on Windows 10 or Windows 11, Notepad++ can execute the sibling script as the current user instead of opening the selected file.

Defensive priority

Defenders should prioritize updating Notepad++ to version 8.9.8 or later to mitigate this vulnerability. Users who cannot update immediately should exercise caution when using the 'Run by system' action on text files.

Recommended defensive actions

• Update Notepad++ to version 8.9.8 or later
• Exercise caution when using the 'Run by system' action on text files
• Monitor for suspicious activity related to Notepad++ usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability. The Notepad++ GitHub repository and official website also offer insights into the issue and its resolution. The vulnerability was reported by a researcher and fixed by the Notepad++ development team. The fix is available in version 8.9.8. Users should verify their Notepad++ version and update to 8.9.8 or later to mitigate this vulnerability. The CVE record and NVD detail provide additional information on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.