Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1047
_____________________________________________________________________

DATE                : 19/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running MobaXterm versions prior
                                       to 26.5.

====================================================================
https://www.incibe.es/en/incibe-cert/notices/aviso/lack-integrity-checks-mobateks-mobaxterm
_____________________________________________________________________

Lack of integrity checks in Mobatek’s MobaXterm

Posted date 19/10/2026
Identificador
INCIBE-2026-758

Importance
4 - High

Affected Resources
MobaXterm Personal Edition (Portable), version 26.4 GA, by Mobatek.

Description
INCIBE has coordinated the disclosure of a high-severity vulnerability
affecting Mobatek’s MobaXterm, a Windows terminal that integrates remote
connection tools and Unix utilities. The vulnerability was discovered
by Pedro J. Nunez-Cacho Fuentes (@tunelko).

This vulnerability has been assigned the following code, CVSS v4.0 base
score, CVSS vector and CWE vulnerability type:

CVE-2026-112161: CVSS v4.0: 8,5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-345


Solution
Update MobaXterm to version 26.5, released on 11 September 2026,
or to a later version.


Detail
CVE-2026-112161: MobaXterm Personal Edition (Portable) 26.4 GA
extracts the CygUtils64.plugin file without first verifying its
integrity. A local attacker with write permissions on this file can
replace the ‘bin/cygwin1.dll’ library contained within it with a
malicious library. When the victim opens a Local Shell session or uses
a Cygwin-based function, the application extracts the component and
loads the tampered library, executing code with the victim’s permissions.
Exploitation requires write access to the plugin and does not,
in itself, involve privilege escalation.


CVE  

Identificador CVE    Severidad   Explotación   Fabricante
CVE-2026-112161      Alta         No           MOBATEK

Nota: El valor de explotación de cada vulnerabilidad corresponde al
momento de publicación de este aviso. Dicho valor puede haber
cambiado en el transcurso del tiempo.

References list
MobaXterm — descarga y registro de cambios

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================