CVE-2026-25866
HighSummary
MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files.
Risk Assessment
An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.
Recommendation
It is recommended to update MobaXterm to version 26.1 or later to mitigate this vulnerability. Additionally, monitor and control application search paths.
Other vulnerabilities in MobaXterm
See all- CVE-2015-7244High
The default configuration of the server in MobaXterm before version 8.3 has a disabled Access Control setting, resulting in no authentication requirement for X11 connections. This allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets.
- CVE-2019-25741Critical
Mobatek MobaXterm version 12.1 has a buffer overflow vulnerability in the username field of session files. A remote attacker can craft a malicious session file that, when imported and executed, triggers a buffer overflow and allows arbitrary code execution.
Original NVD description (English source)
MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.