VULNERABILITY INTELLIGENCE

CVE-2026-112161

CVSS score8.5 HIGH

EPSS probability0.16%

CISA KEVNot currently listed

Published2026-10-19

Last modified2026-10-20

Description

MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell se…