CVE-2026-112161
Received Received - Intake

MobaXterm Portable DLL Hijacking via CygUtils64.plugin

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112161
EUVD
EUVD-2026-104122

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Mobatek MobaXterm 26.4 GA

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MobaXterm Personal Edition (Portable) 26.4 GA fails to verify the integrity of the CygUtils64.plugin file during extraction. A local attacker with write access can replace the legitimate 'bin/cygwin1.dll' library inside the plugin with a malicious version. When a victim uses a Local Shell session or Cygwin-based functions, the application loads the tampered library, executing arbitrary code with the victim's permissions.

Detection Guidance

Check for unauthorized modifications to the CygUtils64.plugin file or bin/cygwin1.dll in MobaXterm's installation directory. Verify file integrity by comparing hashes with known good versions. Monitor for unexpected behavior in Local Shell sessions or Cygwin-based functions.

Impact Analysis

If you use MobaXterm Personal Edition 26.4 GA, an attacker with local write access to your system could replace the cygwin1.dll library. This could allow them to execute malicious code on your machine with your permissions when you open a Local Shell session or use Cygwin functions. The impact includes potential data theft, system compromise, or further malware installation.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or unauthorized access to sensitive information. This may violate GDPR's data protection requirements or HIPAA's security rules, depending on the data processed. Organizations using affected versions may face compliance risks and require remediation to maintain regulatory adherence.

Mitigation Strategies

Update MobaXterm to version 26.5 or later immediately. Restrict write permissions on the CygUtils64.plugin file to prevent unauthorized modifications. Scan systems for signs of tampered libraries or unusual activity in MobaXterm sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112161. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart