MobaXterm CVE-2026-25866

Upgrade to MobaXterm version 26.1 or later, available from the vendor download page at https://mobaxterm.mobatek.net/download-home-edition.html. The vendor has addressed the uncontrolled search path issue in version 26.1 by implementing fully qualified executable paths when launching external applications. Until patching is complete, implement defense-in-depth controls: restrict file system write permissions on directories in the Windows search path (particularly the current directory and application directory) to prevent unauthorized users from planting malicious executables, noting this may impact legitimate workflows requiring file creation in these locations. Apply application whitelisting or endpoint detection and response (EDR) solutions to detect suspicious process creation chains involving MobaXterm and unexpected child processes. Limit MobaXterm usage to standard user accounts rather than privileged accounts where possible, reducing the impact of successful exploitation. For air-gapped or change-controlled environments where immediate patching is not feasible, consider temporarily replacing MobaXterm with alternative SSH/terminal clients until the upgrade maintenance window, accepting the operational disruption this may cause. Review VulnCheck advisory at https://www.vulncheck.com/advisories/mobaxterm-notepad-unquoted-service-path for additional technical details.