Local Code Execution Vulnerability in MobaXterm Personal Edition by Mobatek
CVE-2026-112161

8.5HIGH

Key Information:

Vendor

Mobatek

Status
Mobaxterm
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112161?

MobaXterm Personal Edition (Portable) 26.4 GA has a vulnerability that allows a local attacker with write permissions to the CygUtils64.plugin file to replace the 'bin/cygwin1.dll' library. This issue arises because the application fails to verify the integrity of the library before loading it. When a user initiates a Local Shell session or utilizes a Cygwin-based function, the compromised library is extracted and executed with the victim's permissions. While exploitation does not directly involve privilege escalation, it poses significant security risks as it enables the execution of malicious code.

Affected Version(s)

MobaXterm 26.4 GA

References

https://www.incibe.es/en/incibe-cert/notices/aviso/lack-i...

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro J. Nunez-Cacho Fuentes (@tunelko)
.