Mobatek vulnerabilities
We track 7 vulnerabilities in Mobatek products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 19, 2026.
Latest Mobatek vulnerabilities
- 8.5 High severity
MobaXterm: Insufficient Verification of Data Authenticity
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library
- 8.5 High severity
MobaXterm Personal Edition (Portable): Uncontrolled Search Path Element
MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located in the same directory as the portable executable. Because the application automatically loads the winspool.drv library f
- 8.5 High severity
MobaXterm Personal Edition (Portable): Uncontrolled Search Path Element
MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a temporary directory that is predictable and can be modified by the user. During startup, the application searches for spec
- 7.0 High severity
MobaXterm Home Edition: Untrusted Search Path
A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have h
- 7.8 High severity
MobaXterm: Unquoted Search Path or Element
MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior
- 9.1 Critical severity
Mobaxterm: Use of Hard-coded Credentials
When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are used.
- 8.1 High severity
Mobaxterm: Improper Authentication
An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication.