Notepad++ v8.9.6 — Critical Arbitrary Code Execution via config.xml commandLineInterpreter and shortcuts.xml (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800)
Notepad++ v8.9.6 (TL-2026-0613), also tracked as Notepad++ commandLineInterpreter ACE, is a critical-severity software vulnerability scored CVSS 7.8, first published 2026-05-28. It has no confirmed attribution, affects Notepad++ Project (Don Ho) Notepad++, references 3 CVEs (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800), maps to 16 MITRE ATT&CK techniques (T1036, T1036.005, T1059), and is covered by 9 detection rules and 12 indicators of compromise.
Key facts for TL-2026-0613
- Threat ID
- TL-2026-0613
- Also known as
- Notepad++ commandLineInterpreter ACE, Notepad++ shortcuts.xml ACE
- Severity
- CRITICAL
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-05-28
- Last reviewed
- 2026-05-28
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, government, financial, healthcare, education, enterprise-it
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Notepad++ v8.9.6
Malware and tooling: Notepad++
Notepad++ versions <= v8.9.6 are affected by three vulnerabilities patched in v8.9.6.1 (released 2026-05-26): CVE-2026-48778 and CVE-2026-48800 are critical arbitrary code execution flaws caused by Notepad++ reading attacker-controlled XML values from config.xml (<GUIConfig name="commandLineInterpreter">) and shortcuts.xml and passing them directly to ShellExecute() with no validation, whitelist, or signature check. A public PoC replaces the interpreter value with calc.exe and triggers Windows Calculator when the user invokes File -> Open Containing Folder -> cmd. CVE-2026-48770 is a high-severity crash via malformed XML structure.
How Notepad++ v8.9.6 works
Notepad++ is one of the most widely deployed Windows source-code editors, present on millions of developer workstations and enterprise endpoints. On 2026-05-26 the Notepad++ project released v8.9.6.1, patching three vulnerabilities disclosed by independent security researchers and summarised in Cyber Security News (2026-05-28).
## CVE-2026-48778 — Arbitrary Code Execution via config.xml (CRITICAL)
Notepad++ persists user preferences in %APPDATA%\Notepad++\config.xml. Among many tags is <GUIConfig name="commandLineInterpreter">, which holds the path to the shell invoked by the File -> Open Containing Folder -> cmd context menu. At load time, Parameters.cpp calls NppXml::value() to extract the tag's text content and stores it verbatim — no whitelist, no canonicalisation against %SystemRoot%\System32, no Authenticode check, no length cap.
When the user selects Open Containing Folder -> cmd, Notepad++ builds a command object from the stored string and hands it to ShellExecute(). Because ShellExecute() honours .exe extensions, fully-qualified paths and even URL handlers, the attacker has direct code execution as the interactive user. A publicly demonstrated PoC sets the tag to calc.exe and launches Windows Calculator the next time the menu item is used — confirming full arbitrary code execution capability.
## CVE-2026-48800 — Arbitrary Code Execution via shortcuts.xml (CRITICAL)
Shares the exploitation pattern of CVE-2026-48778 but targets shortcuts.xml (%APPDATA%\Notepad++\shortcuts.xml), the file storing user-bound keyboard shortcuts and macro command associations. The same NppXml::value() -> ShellExecute() flow allows an attacker who can write shortcuts.xml to inject an executable that fires when the bound keystroke or menu item is triggered.
## CVE-2026-48770 — Crash via malformed XML (HIGH)
Notepad++ fails to gracefully handle malformed XML structure during configuration parsing, leading to an application crash. While the crash itself is not remote code execution, it provides denial-of-service capability and may be useful as a precursor primitive for race conditions or partial-state corruption.
## Attack Vectors
Four realistic delivery paths are documented in the disclosure:
1. **Direct same-user write** — Any process running under the victim's user account (low-priv malware, a malicious script, an unsigned tool the user ran once) can drop a tampered config.xml or shortcuts.xml into %APPDATA%\Notepad++\. No elevation required. 2. **Malicious .lnk + -settingsDir= flag** — Notepad++ accepts a -settingsDir=<path> command-line flag that overrides the location of its configuration directory. An attacker delivering a shortcut (or a phishing email with a .lnk attachment) can point Notepad++ at an attacker-staged settings directory containing the tampered XML. The user simply launching the shortcut is sufficient. 3. **Cloud sync poisoning** — Notepad++ supports a user-configurable cloud path for settings. Compromise of the cloud storage account (or of a single endpoint in a sync group) propagates the tampered config to every other endpoint in the same sync set. 4. **Archive extraction social engineering** — Crafted archives (zip/rar/7z) containing a config.xml under a relative AppData-like path can be tricked into landing in %APPDATA%\Notepad++\ via path-traversal-aware extractors or simple user error.
## Exploitation Reliability
The attack is deterministic: any time the user invokes the affected menu item or shortcut, the planted payload executes. No memory corruption, no ASLR/DEP bypass, no race window. Triggering does require user interaction (Open Containing Folder -> cmd, or the bound keystroke), which is why CVSS scoring places this in the local/user-interaction band rather than network-remote — but in interactive desktop environments it is essentially click-to-pwn.
## Detection and Defensive Implications
Because the payload runs as the Notepad++ child process via ShellExecute(), defenders should focus on: - Parent-child anomalies: notepad++.exe spawning anything other than cmd.exe / powershell.exe with the expected commandline - File integrity monitoring on %APPDATA%\Notepad++\config.xml and shortcuts.xml - Command-line argument inspection for the -settingsDir= flag on notepad++.exe invocations - Suspicious .lnk files in user profile directories referencing notepad++.exe with -settingsDir=
Vendor mitigation should add a whitelist of interpreter paths, canonicalise against %SystemRoot%\System32, and surface a user confirmation dialog before executing the configured shell. None of these mitigations are present in v8.9.6.
MITRE ATT&CK techniques used in TL-2026-0613
Defense Evasion
T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal
Execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1203 Exploitation for Client Execution; T1204 User Execution; T1204.001 Malicious Link; T1204.002 Malicious File
lateral-movement
defense-impairment
Persistence
T1547 Boot or Logon Autostart Execution
Initial Access
T1566 Phishing; T1566.001 Spearphishing Attachment
stealth
Affected products and versions in Notepad++ v8.9.6
- Notepad++ Project (Don Ho) — Notepad++
Vulnerable versions: <= v8.9.6; all versions prior to v8.9.6.1
Fixed in: v8.9.6.1
Remediation for Notepad++ v8.9.6
Patches
- Notepad++ v8.9.6.1 (released 2026-05-26) — patches CVE-2026-48770, CVE-2026-48778, CVE-2026-48800
Immediate actions
- Update Notepad++ to v8.9.6.1 or later on all Windows endpoints — official release page: https://notepad-plus-plus.org/downloads/
- Inventory installations across the estate via SCCM / Intune / endpoint agents — Notepad++ is frequently user-installed and missed by patch tooling
- Audit %APPDATA%\Notepad++\config.xml on each host for unexpected values in <GUIConfig name="commandLineInterpreter"> — anything that is not cmd.exe / powershell.exe / pwsh.exe in a System32 path is suspicious
- Audit %APPDATA%\Notepad++\shortcuts.xml for executable paths in command/macro entries
Workarounds
- Until patching is complete, instruct users not to invoke File -> Open Containing Folder -> cmd
- Set %APPDATA%\Notepad++\config.xml and shortcuts.xml to read-only (chmod -w equivalent via ACLs) — note this will break legitimate preference changes
- Block use of the -settingsDir= command-line flag at the EDR / process-creation layer
Longer-term hardening
- Deploy EDR rules alerting on notepad++.exe spawning processes other than cmd.exe / powershell.exe / explorer.exe
- Deploy file integrity monitoring on %APPDATA%\Notepad++\config.xml and shortcuts.xml on developer and admin workstations
- Restrict use of cloud-synced settings folders for security-sensitive applications via group policy
- Add notepad++.exe -settingsDir= command-line patterns to threat-hunting baselines
- Application control (WDAC / AppLocker) policies that constrain which child processes notepad++.exe may launch
CVEs associated with Notepad++ v8.9.6
Weaknesses (CWE) in Notepad++ v8.9.6
CWE-78, CWE-20, CWE-94, CWE-426, CWE-829
Timeline of Notepad++ v8.9.6
- Vulnerabilities CVE-2026-48770, CVE-2026-48778 and CVE-2026-48800 privately disclosed to the Notepad++ project by independent security researchers.
- Notepad++ v8.9.6.1 released, patching all three vulnerabilities. Available via the official downloads page (https://notepad-plus-plus.org/downloads/).
- Detection engineering tasked with parent-child process anomaly rules (notepad++.exe spawning non-shell executables), command-line monitoring for -settingsDir= flag, and file integrity monitoring on %APPDATA%\Notepad++\config.xml and shortcuts.xml.
- Four realistic exploitation paths documented: direct same-user config write, malicious .lnk shortcut using -settingsDir= flag, cloud sync poisoning of the configurable cloud settings path, and archive-extraction social engineering dropping config.xml into %APPDATA%\Notepad++\.
- Threadlinqs Intelligence tracking TL-2026-0613 opened. Threat classified CRITICAL based on vendor severity and public PoC availability.
- Public proof-of-concept demonstrated: replacing <GUIConfig name="commandLineInterpreter"> with calc.exe causes Windows Calculator to launch when the user invokes File -> Open Containing Folder -> cmd. Confirms full arbitrary code execution as the interactive user.
- Cyber Security News publishes coordinated disclosure article detailing CVE-2026-48778 exploitation chain (commandLineInterpreter tag -> ShellExecute()) and CVE-2026-48800 (shortcuts.xml same pattern), including working calc.exe PoC.
- As of 2026-05-29, Notepad++ shipped the fix (v8.9.6.1, 2026-05-26) for CVE-2026-48778/48800/48770, and reporting shows only a public calc.exe PoC with no in-the-wild exploitation or CISA KEV listing (the KEV Notepad++ entry is the unrelated CVE-2025-15556 updater flaw). It stays a live concern given trivial weaponization and a vast unpatched, user-installed base.
Sources cited for Notepad++ v8.9.6
- Critical Notepad++ Vulnerabilities Allow Attackers to Execute Arbitrary Code
- Notepad++ Official Downloads Page
- Notepad++ GitHub Repository
- CVE-2026-48770 — NVD Entry
- CVE-2026-48778 — NVD Entry
- CVE-2026-48800 — NVD Entry
- MITRE ATT&CK T1059 — Command and Scripting Interpreter
- MITRE ATT&CK T1574 — Hijack Execution Flow
Threats related to Notepad++ v8.9.6
Detection coverage for TL-2026-0613
As of 2026-05-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0613 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.