CVE WatchSep 9, 2026

CVE-2026-71858

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the H

CVSS

—

No CVSS

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Aug 17, 2026 · Last modified: Sep 9, 2026 · CWE-78 · CWE-345 · CWE-693

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-10-052026-11-02

Technical description

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++ process, allowing protected file modification and conditional elevated command execution when a local attacker influences settingsDir and a user triggers the macro. This issue is fixed in version 8.9.7.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1215487.8 HIG

—

———Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.2h CVE-2026-1215456.5 MED

—

———Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.2h CVE-2026-1214298.8 HIG

—

———AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.2h CVE-2026-1197427.2 HIG

—

———Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.2h CVE-2026-776918.1 HIG

—

——0ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA3h CVE-2026-1059817.2 HIG

—

——0Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.2h