During startup, the Portable edition of MobaXterm version 26.3 loads DLL files from a predictable temporary directory before consulting system paths. An attacker who can write to that directory can place a malicious DLL, which the program runs automatically when launched. This flaw grants arbitrary code execution with the privileges of the launching user, allowing the attacker to compromise confidentiality, integrity, and availability.

Mobatek’s MobaXterm Personal Edition (Portable) is affected by this flaw. It applies only to version 26.3, build 5154. The fix is delivered in version 26.4, which has already been released by the vendor.

The CVSS score of 8.5 signals a high‑severity issue. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog, but the local attack vector and ability to execute arbitrary code make it a significant risk. If an adversary has local access, they can exploit the predictable DLL path to gain control over the system.