Background
On February 2, 2026, a critical security vulnerability affecting Notepad++ was identified. This exploit allowssoftware updates to be intercepted and redirected to deliver a remote access tool (RAT), now identified as Chrysalis.
Impact
Chrysalis provides operators with full remote access, including command execution, file manipulation, and secondary payload deployment.
Platforms Affected
This vulnerability is present in all versions of Notepad++ prior to v8.8.9. Systems with Notepad++ installed that were active between June–December 2025 should receive patching focus.
Local Observations
The University Information Security Office has taken protective measures in concert with Endpoint Management Services (EMS), which include pushing updates to all centrally managed devices to mitigate risk.
UISO Recommendations
System administrators for devices running Notepad++ v8.8.9 and earlier should upgrade all existing Notepad++ installations to v8.9.1 or later, using a manually verified installer.
If immediate patching is not possible, disable WinGUp (gup.exe) auto-update functionality going forward.
Resources
CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15556
Patch Downloads https://notepad-plus-plus.org/downloads/