---
title: High-Severity Notepad++ Flaws Let Attackers Run Malicious Code — Update Now
description: Update Notepad++ to v8.9.7 to patch high-severity flaws including CVE-2026-48778, which let attackers plant malicious executable paths.
canonical_url: https://codekeeper.co/ticker/notepad-plus-plus-v8-9-6-1-security-patch
---

# High-Severity Notepad++ Flaws Let Attackers Run Malicious Code — Update Now

Update Notepad++ to v8.9.7 to patch high-severity flaws including CVE-2026-48778, which let attackers plant malicious executable paths.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 28, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Notepad++ has patched three security vulnerabilities in version v8.9.6.1, released May 26, 2026 — two of them rated High. The worst, CVE-2026-48778 (CVSS 7.8), lets attackers plant a malicious executable path inside Notepad++'s config.xml. When a user opens a folder via File → Open Containing Folder → cmd, Windows runs the attacker's program instead. No validation, no warning. A second High-severity flaw, CVE-2026-48800, works the same way but targets shortcuts.xml. Neither gets an attacker onto your machine by itself: both need existing write access to your settings files, or a user tricked into loading a poisoned settings folder — through cloud-synced settings, a malicious shortcut, or archive extraction. Anyone running v8.9.6 or earlier should update immediately from the official releases page. Updated August 13, 2026: v8.9.6.1 is no longer enough. The CVE-2026-48800 fix was bypassed days later using path traversal and re-patched in v8.9.6.2; a TOCTOU flaw, CVE-2026-52885, followed in v8.9.6.4; and v8.9.7, released July 14, fixes five more, including another shortcuts.xml bypass. Update to v8.9.7 or later. **Source:** [Cybersecurity News](https://cybersecuritynews.com/critical-notepad-vulnerabilities/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnotepad-plus-plus-v8-9-6-1-security-patch%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Software security Critical GitLab AI Gateway Flaw Allows Remote Code Execution Oct 5, 2026](https://codekeeper.co/ticker/gitlab-ai-gateway-security-update)

[One Year On: How St. Paul's Ransomware Attack Played Out Aug 11, 2026](https://codekeeper.co/ticker/st-paul-cyberattack-disrupts-city-services)

[Cyberattacks Magento Zero-Day Under Attack, No Adobe Fix in Sight Sep 7, 2026](https://codekeeper.co/ticker/stylesmuggler-zero-day-magento-vulnerability)

[Teens Behind 2024 TfL Cyber-Attack Were Already on Police Radar Aug 12, 2026](https://codekeeper.co/ticker/tfl-cyber-attack-repeat-offenders)