CVE-2026-11879: Arbitrary code execution in MobaXterm Personal Edition (Portable)

Published Jun 12, 2026

Updated

MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a temporary directory that is predictable and can be modified by the user. During startup, the application searches for specific DLLs in this location before resorting to the system’s secure paths, enabling an attacker with local access to place a specially crafted DLL to be executed automatically when the victim launches the application.

Affected Software

1 affected component

Mobatek MobaXterm Personal Edition (Portable)=26.3 (Build 5154)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MobaXterm Personal Edition (Portable) to a version that resolves this vulnerability.
Fixed in 26.4

Event History

Jun 12, 2026

CVE Published

via MITRE·01:29 PM

Data Sourced

via MITRE·01:29 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-11879?

CVE-2026-11879 has a high severity rating of 8.5 on the CVSS scale.

How do I fix CVE-2026-11879?

You can fix CVE-2026-11879 by upgrading to MobaXterm Personal Edition (Portable) version 26.4 or later.

What kind of vulnerability is CVE-2026-11879?

CVE-2026-11879 is classified as an arbitrary code execution vulnerability.

What software is affected by CVE-2026-11879?

CVE-2026-11879 affects MobaXterm Personal Edition (Portable) version 26.3.

When was CVE-2026-11879 published?

CVE-2026-11879 was published on June 12, 2026.