Is CVE-2026-77605 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77605 being exploited in the wild.

How severe is CVE-2026-77605?

High severity, with a CVSS score of 7.8, published 22 September 2026.

Which products and versions are affected?

Notepad++ Notepad++ prior to 8.9.8.

Is there a fix for CVE-2026-77605?

A patch was published on 2026-08-23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77605 attacked?

It is attacked with local access.

Am I affected by CVE-2026-77605?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77605: Notepad++ arbitrary code execution via path traversal in Folder as Workspace

CVE-2026-77605 · Severity: high · CVSS 7.8 · Published 2026-09-22

Notepad++ is a widely-used source code editor for Windows. When a user right-clicks a file and selects "Run by system," Notepad++ can be tricked into executing an attacker's command script instead of the user's file if the attacker has placed a malicious .cmd file with the same name in the same directory. This allows arbitrary code execution with the user's privileges.

Quick answers

Is CVE-2026-77605 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77605 being exploited in the wild.
How severe is CVE-2026-77605?: High severity, with a CVSS score of 7.8, published 22 September 2026.
Which products and versions are affected?: Notepad++ Notepad++ prior to 8.9.8.
Is there a fix for CVE-2026-77605?: A patch was published on 2026-08-23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77605 attacked?: It is attacked with local access.
Am I affected by CVE-2026-77605?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Folder as Workspace "Run by system" functionality, which fails to properly resolve the target file path when a sibling .cmd file with the same name exists. An attacker can exploit this by placing a malicious command script alongside a legitimate text file, causing the shell to execute the attacker's script when the user invokes the action on the selected file. The issue affects Windows 10 and 11 and was fixed in version 8.9.8 by using the "\\?\" prefix to ensure exact path resolution.

Affected products

Notepad++ Notepad++ prior to 8.9.8

Timeline

2026-09-22: disclosed
2026-08-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.