CVE-2026-25866: MobaXterm RCE Vulnerability

CVE-2026-25866 Overview

CVE-2026-25866 is an uncontrolled search path element vulnerability (CWE-428) affecting MobaXterm versions prior to 26.1. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.

Critical Impact

Local attackers can achieve arbitrary code execution by exploiting the unquoted search path, enabling them to run malicious code with the privileges of the affected user.

Affected Products

• MobaXterm versions prior to 26.1

Discovery Timeline

• 2026-03-09 - CVE CVE-2026-25866 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-25866

Vulnerability Analysis

This vulnerability stems from insecure application design in MobaXterm's file handling mechanism. When a user opens a remote file, MobaXterm invokes the Windows WinExec API to launch Notepad++ as an external editor. However, the application fails to specify a fully qualified path to the Notepad++ executable, instead relying on the Windows search path resolution mechanism.

Windows search path resolution follows a specific order when locating executables: the application's directory, the current working directory, the Windows system directories, and finally the directories listed in the PATH environment variable. An attacker who can place a malicious executable named notepad++.exe (or a variant) in a location searched before the legitimate Notepad++ installation can hijack execution flow.

This attack requires local access and the ability to write to a directory in the search path, making it a local privilege escalation or code execution vector in multi-user environments or when combined with other vulnerabilities that allow file writes.

Root Cause

The root cause is the use of an unquoted or unqualified executable path in the WinExec function call. When MobaXterm calls WinExec("notepad++ ...") without specifying the full path such as C:\Program Files\Notepad++\notepad++.exe, Windows searches multiple directories to find a matching executable. This behavior can be exploited through DLL hijacking or executable planting attacks.

Attack Vector

The attack requires local access to the target system. An attacker must place a malicious executable in a directory that Windows searches before the legitimate Notepad++ installation directory. Common attack scenarios include:

1. Shared workstation environments: An attacker with limited access places a malicious executable in a shared or writable directory
2. Directory confusion: Exploiting misconfigured permissions on directories in the system PATH
3. Current working directory attacks: If MobaXterm changes its working directory to a user-accessible location when opening remote files

When the victim opens a remote file in MobaXterm, the application triggers WinExec to launch the editor, but the malicious executable runs instead, executing arbitrary code with the victim's privileges.

The attack does not require the execution of a malicious payload to already be on the system—it leverages the search path confusion to substitute a legitimate program call with a malicious one. For detailed technical analysis, see the VulnCheck Advisory on MobaXterm.

Detection Methods for CVE-2026-25866

Indicators of Compromise

• Unexpected executables named notepad++.exe or similar in non-standard directories (e.g., user profile directories, temp folders, or application directories other than the official Notepad++ installation)
• Process execution logs showing notepad++.exe spawned from MobaXterm with unusual parent-child relationships or from unexpected file paths
• File creation events for executables in directories included in the system PATH that do not match known software installations

Detection Strategies

• Monitor process creation events where MobaXterm (MobaXterm.exe) is the parent process and correlate with the expected child process paths
• Implement application whitelisting rules that only allow Notepad++ execution from its legitimate installation directory
• Use endpoint detection to flag any executable named notepad++.exe that does not match known hash values or is located outside Program Files

Monitoring Recommendations

• Enable Windows Sysmon logging for Event ID 1 (Process Create) and Event ID 11 (File Create) to track executable creation and process spawning
• Configure SentinelOne to monitor for executable planting in PATH directories and alert on suspicious process ancestry chains
• Audit directory permissions for all folders in the system PATH to identify writable locations that could be exploited

How to Mitigate CVE-2026-25866

Immediate Actions Required

• Upgrade MobaXterm to version 26.1 or later, which addresses this vulnerability
• Audit system directories in the PATH environment variable for unexpected or suspicious executables
• Restrict write permissions on directories in the system search path to prevent unauthorized executable placement
• Consider temporarily disabling external editor functionality in MobaXterm until the patch is applied

Patch Information

MobaXterm version 26.1 resolves this vulnerability by using fully qualified executable paths when invoking external applications. Users should download the patched version from the official MobaXterm Home Edition Download page or through their enterprise licensing portal if using the Professional edition.

Workarounds

• Manually configure MobaXterm to use the full path to Notepad++ (e.g., C:\Program Files\Notepad++\notepad++.exe) in the application settings if such configuration is available
• Remove write permissions from all directories in the PATH environment variable for non-administrative users
• Implement application control policies that block execution of unsigned or unknown executables from non-standard locations