{"id":"CVE-2026-112161","kind":"vulnerability","aliases":["CVE-2026-112161"],"related":[],"title":"MobaXterm: unverified plugin extraction lets local file swap run code","description":"MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.","summary":"MobaXterm Personal Edition (Portable) 26.4 extracts the CygUtils64.plugin component without checking its integrity first. A local attacker who can write to that plugin can replace bin/cygwin1.dll with a malicious library, which then runs with the victim's permissions when a Local Shell session or a Cygwin-based function is used.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MobaXterm Personal Edition (Portable)","fixed":["26.5"],"affected":"26.4 GA","ecosystem":"vendor"}],"ecosystems":[],"tags":["local","mobaxterm","other","portable-install","windows"],"not_affected_if":["admin-only-write-access","other-version","version-26.5-or-later"],"how_to_check":"- Help > About, or the portable exe/folder name: version 26.4 (GA) is affected, 26.5+ is fixed\n- Check the ACL on the folder holding CygUtils64.plugin (e.g. icacls <folder>): any non-admin user or group with write/modify access means exposed\n- Portable builds in user-writable locations (Downloads, shared drives, USB) are the typical exposure","fix":"Update MobaXterm to 26.5 (released 2026-09-11) or later; 26.5 verifies CygUtils before unpacking and restricts install-folder permissions. Until then, make sure only admins can write to the MobaXterm folder and CygUtils64.plugin.","status":"open","published_at":"2026-10-19T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:00:34+00:00","updated_at":"2026-10-25T03:41:25+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-25T03:00:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"MobaXterm: unverified plugin extraction lets local file swap run code","impact":"high","summary":"MobaXterm Personal Edition (Portable) 26.4 extracts the CygUtils64.plugin component without checking its integrity first. A local attacker who can write to that plugin can replace bin/cygwin1.dll with a malicious library, which then runs with the victim's permissions when a Local Shell session or a Cygwin-based function is used.","category":"other","nicknames":[],"who_cares":["windows","mobaxterm","portable-install"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker code runs with the victim's user permissions on the machine","analyst_note":"Find the vendor fix version for MobaXterm 26.4 and confirm whether the installed (non-portable) edition is affected; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112161.","how_to_check":"- Check the MobaXterm Portable version in the app's About dialog or the installed folder name for `26.4`\n- Check whether `CygUtils64.plugin` in the MobaXterm folder is writable by users other than the admin account","needs_analyst":true,"not_affected_if":["other-version","admin-only-write-access"],"who_is_affected":"Users of the portable build of MobaXterm Personal Edition 26.4 GA on shared or multi-user Windows machines, or where the MobaXterm folder is writable by other accounts. Exploitation needs local write access to the plugin file, so systems where only administrators can write to the install location are much less exposed. Installed (non-portable) builds are not stated in the sources.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":3407,"output_tokens":616,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor fix version for MobaXterm 26.4 and confirm whether the installed (non-portable) edition is affected; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112161.","search":"'-112161':13A,16A '-2026':12A,15A '26.4':32B,83C 'access':150C 'applic':131C 'attack':44B,96C 'base':75B,128C 'bin/cygwin1.dll':53B,106C 'check':38B 'code':10A,141C 'compon':36B,134C 'contain':108C 'cve':11A,14A 'cygutils64.plugin':35B,87C 'cygwin':74B,127C 'cygwin-bas':73B,126C 'edit':30B,81C 'edition':19A 'escal':161C 'execut':140C 'exploit':147C 'extract':4A,33B,85C,132C 'file':7A,88C,102C 'first':41B,90C 'function':76B,129C 'ga':84C 'instal':26B 'integr':40B,93C 'involv':159C 'let':5A 'librari':57B,107C,114C,139C 'load':136C 'local':6A,21B,43B,68B,95C,120C 'malici':56B,113C 'mobaxterm':1A,17A,22B,28B,79C 'open':118C 'permiss':65B,99C,146C 'person':29B,80C 'personal':18A 'plugin':3A,50B,153C 'portabl':25B,31B,82C 'portable':20A 'portable-instal':24B 'privileg':160C 'replac':52B,104C 'requir':148C 'run':9A,60B 'session':70B,122C 'shell':69B,121C 'swap':8A 'tamper':138C 'unverifi':2A 'use':78B,124C 'verifi':91C 'victim':63B,117C,144C 'window':27B 'within':109C 'without':37B,89C 'write':47B,98C,149C","nicknames":[],"mitigations":[],"who_affected":"Teams running MobaXterm Personal Edition Portable 26.4 GA, especially from a folder other users or processes can write to (shared workstations, jump hosts, network shares). Exploitation needs local write access to CygUtils64.plugin and runs code as the user who opens a Local Shell or Cygwin function. Installer edition is not named as affected by the CVE record or INCIBE; Pros with admin-only-writable install folders can mostly skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:41:25Z","by":"analyst","run_id":772}},"analyst_revisit_at":null,"first_public_at":"2026-10-19T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112161","severity":null,"published_at":"2026-10-19T09:17:08+00:00","modified_at":"2026-10-20T19:17:31+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112161:772","url":null,"severity":null,"published_at":"2026-10-25T03:41:25+00:00","modified_at":"2026-10-25T03:41:25+00:00","first_seen_at":"2026-10-25T03:41:25+00:00","fetched_at":"2026-10-25T03:41:25+00:00","note":"Fixed in 26.5 (2026-09-11): vendor changelog adds a CygUtils integrity check before unpack (changelog typos the CVE as CVE-2016-112161) and restricts install-folder permissions; INCIBE advisory says update to 26.5+. Only Portable 26.4 GA is listed as affected; installer edition not stated by any source. No exploitation or PoC found."}],"documents":[{"id":3286,"url":"https://mobaxterm.mobatek.net/download-home-edition.html","title":"MobaXterm Home Edition changelog (26.5)","kind":"vendor","source":"analyst","text":"Version 26.5 (2026-09-11): Improvement: added a verification step to ensure that the CygUtils file has not been altered before it is unpacked (fixes CVE-2016-112161 [sic]). Improvement: restricted permissions for the installation folder.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3288,"url":"https://www.incibe.es/index.php/en/incibe-cert/notices/aviso/lack-integrity-checks-mobateks-mobaxterm","title":"INCIBE-CERT: Lack of integrity checks in Mobatek's MobaXterm","kind":"advisory","source":"analyst","text":"Affected: MobaXterm Personal Edition (Portable) 26.4 GA. Solution: Update MobaXterm to version 26.5, released on 11 September 2026, or later. Discovered by Pedro J. Nunez-Cacho Fuentes (@tunelko). CVSS v4.0 8.5, CWE-345.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}