MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without validating its integrity. An attacker with local write permission on this file can replace the bundled bin/cygwin1.dll library with a malicious DLL. When a user opens a Local Shell session or triggers a Cygwin‑based feature, MobaXterm re‑extracts the plugin and loads the altered library, causing the application to execute the attacker’s code within the victim’s user context. The vulnerability is a traditional integrity check failure (CWE‑345) that permits arbitrary code execution but does not provide privilege escalation beyond the permissions already held by the compromised user.

Mobatek's MobaXterm Personal Edition Portable, version 26.4 GA, is affected. The vendor released an official fix in version 26.5, made available on 11 September 2026. No other release information is specified in the CVE entry.

The flaw carries a high CVSS score of 8.5. The EPSS score is not available, implying the likelihood of exploitation is unclear, though the issue requires local write access to the plugin file. Consequently, the vulnerability is limited to users who already have such permission and does not enable remote exploitation or privilege escalation. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits at the time of analysis.