Which versions of Mobaxterm Home Edition are affected by EUVD-2026-23374?

MobaXterm Home Edition versions 26.1 and earlier contain a DLL hijacking vulnerability that allows local users with low privileges to execute arbitrary code on affected systems.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-23374?

Yes, a public proof-of-concept exploit is available for EUVD-2026-23374. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-23374?

Within 24 hours: Identify all systems running MobaXterm Home Edition version 26.1 or earlier using inventory or endpoint detection tools. Within 7 days: Deploy MobaXterm Home Edition version 26.2 or later to all affected systems through standard patch management procedures; prioritize systems with shared or multi-user access. Within 30 days: Verify successful deployment across the environment and confirm no systems remain on vulnerable versions.

Mobaxterm Home Edition EUVD-2026-23374

Q: What is the CVSS score of EUVD-2026-23374?

EUVD-2026-23374 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-6421 MEDIUM

Uncontrolled Search Path Element (CWE-427)

2026-04-17 VulDB

GHSA-hf75-j846-hmxr

Information Disclosure Mobaxterm Home Edition Mobatek

6.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:12 NVD

7.3 (HIGH) 6.4 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 17, 2026 - 06:27 vuln.today

CVSS changed

Apr 17, 2026 - 06:22 NVD

7.0 (HIGH) 7.3 (HIGH)

EUVD ID Assigned

Apr 17, 2026 - 06:15 euvd

EUVD-2026-23374

Analysis Generated

Apr 17, 2026 - 06:15 vuln.today

Patch released

Apr 17, 2026 - 06:15 nvd

Patch available

CVE Published

Apr 17, 2026 - 05:45 nvd

MEDIUM 6.4

DescriptionCVE.org

A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 26.2 is able to mitigate this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

DLL hijacking in MobaXterm Home Edition ≤26.1 allows local attackers with low privileges to execute arbitrary code by planting a malicious msimg32.dll in an uncontrolled search path location. Exploitation is complex (CVSS AC:H) but a public POC exists. Mobatek released version 26.2 to address the issue. EPSS data not provided, not listed in CISA KEV, suggesting limited active exploitation despite public proof-of-concept availability.

Technical ContextAI

This is a CWE-427 uncontrolled search path element vulnerability, commonly known as DLL hijacking or DLL preloading. MobaXterm (a terminal emulator and remote connection tool for Windows) loads msimg32.dll without properly validating the search path, following Windows DLL search order. An attacker who can write to directories earlier in the search order (current directory, application directory, or PATH directories) can place a malicious msimg32.dll that gets loaded instead of the legitimate system library. The CVSS vector AV:L/PR:L indicates the attacker needs local access and low-level user privileges, while AC:H reflects the complexity of positioning the malicious DLL correctly and triggering its load. The vulnerability affects MobaXterm Home Edition through version 26.1 per CPE cpe:2.3:a:mobatek:mobaxterm_home_edition:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to MobaXterm Home Edition version 26.2 or later, available from Mobatek at https://mobaxterm.mobatek.net/download-home-edition.html (direct installer: https://download.mobatek.net/2622026032581854/MobaXterm_Installer_v26.2.zip). Vendor responded professionally and released fix promptly per description. If immediate upgrade is not feasible, implement compensating controls: restrict write permissions to MobaXterm installation directory to Administrators only, prevent standard users from writing to directories in the system PATH, monitor for unexpected msimg32.dll files in non-system locations using file integrity monitoring, and deploy application whitelisting to block execution of DLLs from user-writable paths. These mitigations increase operational overhead and may require local administrator involvement for legitimate software installations. Verify current MobaXterm version via Help > About before and after upgrade to confirm successful remediation.