Live › vulnerability › CVE-2026-112161
Go to dashboardMobaXterm Personal Edition (Portable) 26.4 extracts the CygUtils64.plugin component without checking its integrity first. A local attacker who can write to that plugin can replace bin/cygwin1.dll with a malicious library, which then runs with the victim's permissions when a Local Shell session or a Cygwin-based function is used.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running MobaXterm Personal Edition Portable 26.4 GA, especially from a folder other users or processes can write to (shared workstations, jump hosts, network shares). Exploitation needs local write access to CygUtils64.plugin and runs code as the user who opens a Local Shell or Cygwin function. Installer edition is not named as affected by the CVE record or INCIBE; Pros with admin-only-writable install folders can mostly skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| MobaXterm Personal Edition (Portable) | vendor | 26.4 GA | 26.5 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.
This page as .md · .json · in your agent: get_signal("CVE-2026-112161")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.