---
id: "CVE-2026-112161"
kind: "vulnerability"
aliases: ["CVE-2026-112161"]
title: "MobaXterm: unverified plugin extraction lets local file swap run code"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "MobaXterm Personal Edition (Portable)", "fixed": ["26.5"], "affected": "26.4 GA", "ecosystem": "vendor"}]
ecosystems: []
tags: ["local", "mobaxterm", "other", "portable-install", "windows"]
not_affected_if: ["admin-only-write-access", "other-version", "version-26.5-or-later"]
published_at: "2026-10-19T09:17:08+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:41:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112161", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:41:25+00:00"}]
---

# MobaXterm: unverified plugin extraction lets local file swap run code

MobaXterm Personal Edition (Portable) 26.4 extracts the CygUtils64.plugin component without checking its integrity first. A local attacker who can write to that plugin can replace bin/cygwin1.dll with a malicious library, which then runs with the victim's permissions when a Local Shell session or a Cygwin-based function is used.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MobaXterm Personal Edition (Portable) affected 26.4 GA fixed 26.5

## How to check

- Help > About, or the portable exe/folder name: version 26.4 (GA) is affected, 26.5+ is fixed
- Check the ACL on the folder holding CygUtils64.plugin (e.g. icacls <folder>): any non-admin user or group with write/modify access means exposed
- Portable builds in user-writable locations (Downloads, shared drives, USB) are the typical exposure

## Fix

Update MobaXterm to 26.5 (released 2026-09-11) or later; 26.5 verifies CygUtils before unpacking and restricts install-folder permissions. Until then, make sure only admins can write to the MobaXterm folder and CygUtils64.plugin.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112161
- 2026-10-25T03:41:25+00:00 analyst — Fixed in 26.5 (2026-09-11): vendor changelog adds a CygUtils integrity check before unpack (changelog typos the CVE as CVE-2016-112161) and restricts install-folder permissions; INCIBE advisory says update to 26.5+. Only Portable 26.4 GA is listed as affected; installer edition not stated by any source. No exploitation or PoC found.

## Documents

- [advisory] INCIBE-CERT: Lack of integrity checks in Mobatek's MobaXterm https://www.incibe.es/index.php/en/incibe-cert/notices/aviso/lack-integrity-checks-mobateks-mobaxterm
- [fix] MobaXterm Home Edition changelog (26.5) https://mobaxterm.mobatek.net/download-home-edition.html

## From the sources

MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_