MobaXterm 26.4 GA Patch Urgent for Local Code Execution Risk
A high-severity flaw in the latest MobaXterm version allows local attackers to execute arbitrary code via tampered plugin libraries.
Key points
- CVE-2026-112161 affects MobaXterm Personal Edition 26.4 GA.
- Attackers can replace a DLL within a plugin to run malicious code.
- No official patch or fix has been confirmed by the vendor yet.
MobaXterm Personal Edition 26.4 GA contains an integrity verification failure that exposes users to local code execution. The flaw, tracked as CVE-2026-112161, allows attackers with write permissions to modify plugin components. This vulnerability enables the loading of malicious libraries when specific shell functions are activated.
How it unfolded
- Mobatek released MobaXterm Personal Edition 26.4 GA.
- The National Vulnerability Database recorded CVE-2026-112161 with a CVSS score of 8.5.
- The flaw was identified as a failure to verify the integrity of the CygUtils64.plugin file.
Who is affected
The vulnerability impacts users of MobaXterm Personal Edition 26.4 GA specifically. According to the National Vulnerability Database, the issue stems from the application extracting the CygUtils64.plugin file without verifying its integrity. This affects any local system where an attacker has write permissions to the plugin directory.
Our take on the response
The absence of a confirmed patch leaves administrators in a difficult position. The high CVSS score indicates significant risk, particularly for systems with shared user access. That suggests teams must treat local privilege boundaries with extreme caution until a vendor update is released.
Who needs to act first
Teams should immediately isolate systems running MobaXterm 26.4 GA from shared network drives. Check whether any users have write access to the installation directory or plugin folders. Restrict file permissions to prevent unauthorized modification of the CygUtils64.plugin file. Monitor for unexpected process launches when users open local shell sessions.
What to do and how to stay safe: MobaXterm
- Restrict write permissions on the MobaXterm installation directory to administrative accounts only.
- Monitor local shell session activity for unexpected code execution or library loads.
- Disable Cygwin-based functions within MobaXterm settings until a patch is available.
- Isolate affected workstations from sensitive internal networks to limit lateral movement.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112161?
The National Vulnerability Database rates the severity as 8.5, which is classified as high.
Does this vulnerability allow privilege escalation?
No, the source material states that exploitation does not involve privilege escalation.
Is there a fix available for MobaXterm 26.4 GA?
No fix has been confirmed yet according to the available source material.
