CVE-2026-112161
8.5HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-345
Impact
A local attacker can run arbitrary code with your user permissions when you launch a local shell session. To exploit this, the attacker needs existing local write access to your CygUtils64.plugin file.
Root cause
The portable edition extracts and loads DLLs from the CygUtils64.plugin file without verifying the integrity of the plugin archive.
Affected systems
MobaXterm Personal Edition (Portable) 26.4 GA
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Check the vendor advisory for a patched release beyond 26.4 GA. As an interim workaround, ensure the directory containing MobaXterm and CygUtils64.plugin has restricted filesystem ACLs so unauthorized users cannot modify the files.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.