MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 9, 2026 · NIST NVD

   Detected

   MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.

2. Jun 17, 2026 · NIST NVD

   Updated

   MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.

Affected

• cpe mobatek/mobaxtermversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-25866

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-25866

  MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malici

  nvd.nist.gov

References

• Vendor Advisory · mobaxterm.mobatek.net
• Third Party Advisory · vulncheck.com