Heise.De Critical Notepad++ Vulnerabilities Allow Remote Code Execution
Article Content
- •Two critical vulnerabilities in Notepad++ allow arbitrary code execution.
- •Affected versions include all prior to 8.9.6; users must update to 8.9.6.1.
- •Attackers can exploit these flaws through tampered XML configuration files.
Notepad++ has released version 8.9.6.1 to patch three vulnerabilities, including two critical flaws (CVE-2026-48778 and CVE-2026-48800) that enable arbitrary code execution on Windows systems. These vulnerabilities arise from improper handling of XML configuration files, allowing local attackers to execute commands by tampering with user settings. The flaws affect all versions up to 8.9.6 and were disclosed on May 26, 2026. CVE-2026-48778 allows manipulation of the command-line interpreter path, while CVE-2026-48800 targets user-defined commands in the shortcuts.xml file. Both require user interaction or prior access to the AppData directory. A third lower-severity vulnerability, CVE-2026-48770, was also patched. Users are urged to update immediately to mitigate risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (11)
Following this threat?
Track CVE-2026-48770 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…