MobaXterm EUVD-2026-104122

Requires that the attacker already has local write permission to the CygUtils64.plugin file (or the bin/cygwin1.dll it contains) inside the portable MobaXterm 26.4 GA installation - typically only achievable on multi-user, shared, or already-partly-compromised Windows hosts, or where the portable folder sits on a world-writable path. Exploitation is further gated by victim action: the malicious DLL is only loaded when the victim opens a Local Shell session or uses a Cygwin-based function, so an idle or SSH-only user never triggers it. Execution occurs with the victim's own privileges and does not by itself escalate privileges. These constraints (local-only vector, required pre-existing write access, and required victim interaction) substantially limit realistic exploitation despite the high CVSS impact metrics.

This is a local code-execution flaw (CVSS 4.0 8.5 per INCIBE) rooted in missing integrity verification (CWE-345) of the bundled CygUtils64.plugin, which MobaXterm extracts and loads without validating cygwin1.dll. The provided vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N signals full confidentiality/integrity/availability impact to the vulnerable system but NO scope change to subsequent systems (SC/SI/SA:N) - consistent with the description's statement that exploitation 'does not, in itself, involve privilege escalation.' Real-world risk is moderate, not critical: AV:L means no remote reachability, PR:L means the attacker already needs a local account with write access to the plugin file, and in practice the victim must open a Local Shell or invoke a Cygwin function to trigger loading - i.e., user interaction, which the vendor-supplied UI:N appears to understate. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. CONFLICT TO NOTE: the input 'Privilege Escalation' tag directly contradicts the description, which explicitly denies privilege escalation - treat the tag as unreliable. Net: a legitimate local DLL-hijack/supply-integrity weakness best prioritized on shared or multi-user Windows hosts, well below internet-facing RCE priority.

On a shared or compromised Windows host where the portable MobaXterm folder is writable by a low-privileged user, an attacker overwrites bin/cygwin1.dll inside CygUtils64.plugin with a malicious library. The next time the victim launches a Local Shell session or any Cygwin-based feature, MobaXterm extracts and loads the tampered DLL, running the attacker's code with the victim's privileges. No public exploit code was identified, and success depends on the victim subsequently initiating a Cygwin/Local Shell action.