CVE-2026-112161 Details
Description
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.
A vulnerability exists in Mobatek MobaXterm Personal Edition (Portable) version 26.4 GA, where the application extracts the CygUtils64.plugin file without verifying its integrity. This flaw allows a local attacker with write permissions on the plugin file to replace the 'bin/cygwin1.dll' library within it with a malicious version. When the victim initiates a Local Shell session or uses a Cygwin-based function, MobaXterm loads the compromised library, executing arbitrary code with the user's permissions. While exploitation requires write access to the plugin, it does not involve privilege escalation.
Users are advised to update MobaXterm to version 26.5 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/lack-integrity-checks-mobateks-mobaxterm | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mobatek MobaXterm Personal Edition | 26.4 GA |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |