# CVE-2026-85288: Notepad++ HMAC validation bypass in macro execution

Source: https://junglewise.ai/threats/cve-2026-85288-notepad-is-a-free-and-open-source-source-code-editor-prior-to-8-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85288 · Severity: medium · CVSS 6.7 · Published 2026-09-22

Notepad++ is a text editor used for code development that includes a macro feature to automate repetitive tasks. Prior to version 8.9.8, the application failed to properly validate macro files in the "Run a Macro Multiple Times" dialog, allowing a user with access to modify the configuration to execute arbitrary commands with the privileges of the current user. An attacker who gains access to a user's configuration files could use this to execute malicious programs.

## Quick answers

**Is CVE-2026-85288 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85288 being exploited in the wild.

**How severe is CVE-2026-85288?** Medium severity, with a CVSS score of 6.7, published 22 September 2026.

**Which products and versions are affected?** Notepad++ Notepad++ prior to 8.9.8.

**Is there a fix for CVE-2026-85288?** A patch was published on 2026-08-23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85288 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-85288?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an HMAC validation bypass in the shortcuts.xml macro file handler. The WM_MACRODLGRUNMACRO entry point (Run a Macro Multiple Times dialog) calls macroPlayback() without performing the HMAC validation checks that are applied by the command() function, allowing tampered macros blocked through normal menu/shortcut execution paths to run through the multi-run dialog. An attacker who can modify shortcuts.xml can invoke internal Notepad++ commands that launch external programs.

## Affected products

- Notepad++ Notepad++ prior to 8.9.8

## Timeline

- 2026-09-22: disclosed
- 2026-08-23: patched

## References

- [https://github.com/notepad-plus-plus/notepad-plus-plus/commit/4cd74cb9347b9c6caaab17d999e24fc9ed228ff7](https://github.com/notepad-plus-plus/notepad-plus-plus/commit/4cd74cb9347b9c6caaab17d999e24fc9ed228ff7)
- [https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8](https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8)