CVE-2026-11879 Overview
CVE-2026-11879 is a DLL hijacking vulnerability affecting MobaXterm Personal Edition (Portable) version 26.3 (Build 5154). The application searches a predictable, user-writable temporary directory for specific DLLs before falling back to secure system paths. An attacker with local access can place a malicious DLL in that directory, which the application loads automatically at startup. This results in arbitrary code execution under the context of the user launching MobaXterm. The flaw maps to [CWE-427] Uncontrolled Search Path Element.
Critical Impact
Local attackers can achieve arbitrary code execution by planting a crafted DLL in a predictable temporary directory loaded during MobaXterm startup.
Affected Products
- MobaXterm Personal Edition (Portable) 26.3 (Build 5154)
- Mobatek MobaXterm Portable distributions using the affected build
- Windows endpoints where the vulnerable portable binary is executed
Discovery Timeline
- 2026-06-12 - CVE-2026-11879 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-11879
Vulnerability Analysis
MobaXterm Personal Edition (Portable) 26.3 (Build 5154) loads dependent libraries from a temporary directory before consulting the secure Windows search paths. The directory location is predictable and writable by the standard user account running the application. This violates the secure DLL search order recommended by Microsoft. The issue is classified under [CWE-427] Uncontrolled Search Path Element.
Because MobaXterm is distributed as a portable executable, users commonly run it from removable media or user-controlled directories. This expands the attack surface to any context in which a low-privileged user can stage files in the target temporary path. Successful exploitation grants the attacker code execution with the privileges of the victim user, compromising confidentiality, integrity, and availability of the session.
Root Cause
The root cause is an insecure library search order. During startup, MobaXterm resolves specific DLL names from a temporary working directory that any user can modify. Windows prioritizes this writable location over System32 and other trusted paths because the application does not call SetDefaultDllDirectories or use fully qualified paths when loading the affected modules.
Attack Vector
The attack requires local access and low privileges. An attacker stages a malicious DLL with a name MobaXterm searches for in the predictable temporary directory. When the victim launches MobaXterm, the loader maps the attacker-controlled DLL into the process and executes its DllMain entry point. No user interaction beyond launching the application is required. See the INCIBE Security Notice for the original advisory.
No verified proof-of-concept code is published. The vulnerability mechanism
involves placing a crafted DLL matching a name expected by MobaXterm into
the predictable temporary directory, then waiting for the victim to launch
the portable executable.
Detection Methods for CVE-2026-11879
Indicators of Compromise
- Unexpected DLL files appearing in the MobaXterm portable temporary working directory prior to application launch.
- MobaXterm.exe loading modules from a user-writable path rather than C:\Windows\System32.
- Child processes spawned by MobaXterm.exe that do not match the application's normal SSH, telnet, or X server behavior.
Detection Strategies
- Hunt for ImageLoad events where the loaded DLL path resides in %TEMP%, %LOCALAPPDATA%\Temp, or other user-writable directories under the MobaXterm process tree.
- Correlate file-write events targeting MobaXterm's temporary directory with subsequent process launches of MobaXterm.exe.
- Apply Sysmon Event ID 7 rules to flag unsigned or recently created DLLs loaded by the MobaXterm process.
Monitoring Recommendations
- Baseline the list of DLLs legitimately loaded by MobaXterm 26.3 and alert on deviations.
- Monitor portable application directories on shared workstations and jump hosts for unauthorized file creation.
- Forward endpoint module-load telemetry to a central data lake for retrospective hunting across the fleet.
How to Mitigate CVE-2026-11879
Immediate Actions Required
- Restrict execution of MobaXterm Personal Edition (Portable) 26.3 (Build 5154) until a fixed build is available from Mobatek.
- Block write access to the predictable temporary directory used by MobaXterm for non-administrative users.
- Inventory endpoints running the portable build and prioritize remediation on shared or multi-user systems.
Patch Information
No fixed version is referenced in the NVD record at the time of publication. Consult the INCIBE Security Notice and Mobatek release notes for an updated build addressing the insecure DLL search path.
Workarounds
- Run MobaXterm from a directory whose temporary path is not writable by standard users, such as a location protected by NTFS ACLs.
- Deploy application control policies (AppLocker or Windows Defender Application Control) to block unsigned DLLs from loading into MobaXterm.exe.
- Replace the portable edition with the installer edition where feasible, since installed builds resolve dependencies from protected directories.
# Example: Restrict write access to the MobaXterm portable temp directory
icacls "C:\Path\To\MobaXterm\slash\tmp" /inheritance:r
icacls "C:\Path\To\MobaXterm\slash\tmp" /grant:r "Administrators:(OI)(CI)F"
icacls "C:\Path\To\MobaXterm\slash\tmp" /grant:r "SYSTEM:(OI)(CI)F"
icacls "C:\Path\To\MobaXterm\slash\tmp" /deny "Users:(OI)(CI)(W)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
