CVE-2026-25866: Mobatek Mobaxterm

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.

Affected products

• Mobatek Mobaxterm: before 26.1 (fixed in 26.1)

Published 2026-03-09. Last modified 2026-06-17.