CVE-2026-25866: MobaXterm < 26.1 Notepad++ Unquoted Service Path
MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25866?
CVE-2026-25866 is considered a medium severity vulnerability due to the potential for local privilege escalation.
How do I fix CVE-2026-25866?
To fix CVE-2026-25866, update MobaXterm to version 26.1 or later to ensure the service path is properly quoted.
What can an attacker do with CVE-2026-25866?
An attacker can exploit CVE-2026-25866 to execute arbitrary commands with the privileges of the user running MobaXterm.
Which versions of MobaXterm are affected by CVE-2026-25866?
Versions of MobaXterm prior to 26.1 are affected by CVE-2026-25866.
Is there a workaround for CVE-2026-25866?
A temporary workaround for CVE-2026-25866 is to avoid opening remote files through MobaXterm until it can be updated.