CVE-2026-85288 Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog
Attackers can bypass HMAC validation in Notepad++ to execute arbitrary macros and launch external programs via the multi-run dialog.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-85288?
CVE-2026-85288 is a medium-severity vulnerability in notepad-plus-plus, published on 22 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.
Which versions are affected by CVE-2026-85288?
How do I fix CVE-2026-85288?
No fix has been published for CVE-2026-85288 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85288 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85288 exists.
Sources
Also known as GHSA-759j-g8j4-867p.