MobaXterm CVE-2026-112161: Plugin Integrity Gap Enables Local Code Execution

MobaXterm Personal Edition 26.4 GA contains a high-severity vulnerability that permits local code execution. The flaw stems from the application failing to verify the integrity of its plugin files before extraction.

What happened

According to the National Vulnerability Database, CVE-2026-112161 carries a CVSS score of 8.5. The vulnerability exists because MobaXterm extracts the CygUtils64.plugin file without verifying its integrity. A local attacker who possesses write permissions for this specific file can replace the legitimate ‘bin/cygwin1.dll’ library inside the plugin with a malicious alternative.

When the victim opens a Local Shell session or utilises any Cygwin-based function, the application extracts the compromised component. The software then loads the tampered library, resulting in code execution under the victim’s permissions. This process relies on the attacker having prior write access to the plugin directory.

Why it matters

This issue is classified as a high-severity risk due to the ease of local exploitation. Security teams must assess environments where users have write access to MobaXterm installation directories. The vulnerability does not involve privilege escalation, meaning the attacker retains only the permissions of the victim user. Executing arbitrary code with user-level permissions allows the attacker to run commands as the victim. The affected version is specifically MobaXterm Personal Edition 26.4 GA. Organisations using this portable edition need to review file permissions immediately.

Next steps

• Audit file permissions on directories containing MobaXterm Portable installations.
• Restrict write access to plugin folders for standard user accounts.
• Monitor for unexpected library replacements within the CygUtils64.plugin archive.
• Verify that no unauthorised users have modified the bin/cygwin1.dll file.

Detection notes

Security operations teams should monitor for unusual file modifications within application plugin directories. Look for changes to archive contents or library files shortly before application launch. Endpoint detection solutions may flag unexpected DLL loads or parent-child process relationships involving shell interpreters. Check whether integrity monitoring alerts have triggered for known application binaries.

Investigate any local shell sessions initiated by users with limited privileges. Verify that loaded libraries match expected checksums during startup routines. Contain affected endpoints by isolating them from the network if malicious activity is confirmed. Review access logs for accounts that modified plugin files prior to execution events.

What to do and how to stay safe: MobaXterm

• Restrict write permissions on MobaXterm directories to prevent unauthorised file modification.
• Implement application whitelisting to block execution of unverified DLLs.
• Monitor for unexpected file changes in plugin folders using integrity monitoring tools.
• Isolate affected systems immediately if suspicious library loading is detected.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which version of MobaXterm is affected by CVE-2026-112161?

MobaXterm Personal Edition (Portable) 26.4 GA is the affected version.

Does this vulnerability allow privilege escalation?

No, exploitation does not involve privilege escalation and runs with victim permissions.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates it as 8.5, which is high severity.