CVE-2026-6421: MobaXterm Path Traversal Vulnerability

CVE-2026-6421 Overview

A high-severity DLL hijacking vulnerability has been identified in Mobatek MobaXterm Home Edition versions up to 26.1. This vulnerability exists in the library msimg32.dll and stems from an uncontrolled search path issue (CWE-426). When exploited, an attacker with local access can manipulate the DLL search path to load a malicious DLL, potentially leading to arbitrary code execution with the privileges of the affected application.

The attack requires local access and is considered to have high complexity, making practical exploitation more difficult. However, successful exploitation could result in complete compromise of confidentiality, integrity, and availability on the affected system. The exploit has been disclosed publicly, increasing the risk of active exploitation attempts.

Critical Impact

Successful exploitation allows local attackers to execute arbitrary code by placing a malicious msimg32.dll in the application's search path, potentially leading to full system compromise.

Affected Products

• Mobatek MobaXterm Home Edition versions up to 26.1
• Systems where MobaXterm searches for DLLs in user-writable directories

Discovery Timeline

• 2026-04-17 - CVE-2026-6421 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6421

Vulnerability Analysis

This vulnerability is classified as an Uncontrolled Search Path Element (CWE-426). MobaXterm Home Edition up to version 26.1 improperly handles DLL loading, allowing the application to search for msimg32.dll in directories that may be controlled by an attacker. When the application attempts to load this DLL, it follows the Windows DLL search order, which can include the current working directory or other user-writable locations before the legitimate system directories.

An attacker who can place a malicious msimg32.dll in a location that precedes the legitimate DLL in the search path can achieve code execution in the context of the MobaXterm process. While the attack requires local access and high complexity, successful exploitation grants the attacker the ability to compromise the confidentiality, integrity, and availability of the target system.

Root Cause

The root cause is improper DLL search path handling in MobaXterm Home Edition. The application does not enforce safe DLL loading practices, allowing Windows to search for msimg32.dll in user-controllable directories. This occurs because the application fails to specify a fully qualified path when loading the DLL or does not use secure DLL loading APIs that restrict the search path to trusted system directories.

Attack Vector

The attack vector is local, requiring the attacker to have some level of access to the target system. The exploitation process involves:

1. Initial Access: The attacker must have local access to the system where MobaXterm is installed
2. Malicious DLL Placement: The attacker places a crafted msimg32.dll in a directory that appears earlier in the DLL search path than the legitimate system DLL
3. Trigger Execution: When MobaXterm is launched or performs an operation that loads msimg32.dll, the malicious DLL is loaded instead
4. Code Execution: The attacker's code executes within the MobaXterm process context, potentially with elevated privileges if MobaXterm is running with higher permissions

The high complexity rating indicates that successful exploitation may require specific conditions such as user interaction, specific directory permissions, or particular system configurations.

Detection Methods for CVE-2026-6421

Indicators of Compromise

• Unexpected msimg32.dll files located in the MobaXterm installation directory or user-writable paths
• DLL files with unusual file hashes in application directories
• Process execution anomalies where MobaXterm loads DLLs from non-standard locations
• Suspicious file creation events in directories associated with MobaXterm

Detection Strategies

• Monitor for DLL loading events using tools like Sysmon, specifically Event ID 7 (Image Loaded) where MobaXterm loads msimg32.dll from non-system directories
• Implement file integrity monitoring on MobaXterm installation directories to detect unauthorized DLL additions
• Use endpoint detection and response (EDR) solutions to identify DLL hijacking attempts based on behavioral analysis
• Audit file creation events in the MobaXterm installation directory and user profile directories

Monitoring Recommendations

• Configure application whitelisting to prevent unauthorized DLLs from loading in MobaXterm
• Enable Windows Event Logging for DLL load operations and review logs for anomalies
• Deploy SentinelOne agents to leverage behavioral AI detection for DLL hijacking attack patterns
• Establish baseline DLL loading behavior for MobaXterm to identify deviations

How to Mitigate CVE-2026-6421

Immediate Actions Required

• Upgrade MobaXterm Home Edition to version 26.2 immediately, which addresses this vulnerability
• Audit systems for any suspicious DLL files in MobaXterm-related directories
• Verify file integrity of existing MobaXterm installations against known-good hashes
• Restrict write permissions on the MobaXterm installation directory to administrators only

Patch Information

Mobatek has released MobaXterm Home Edition version 26.2 to address this vulnerability. The vendor was contacted early, responded professionally, and quickly released the fixed version. The patched installer is available for download from the MobaXterm Home Edition Download Page or directly via the MobaXterm Installer v26.2.

Organizations should prioritize upgrading all MobaXterm installations to version 26.2 or later. Additional vulnerability details are available at VulDB Vulnerability Details.

Workarounds

• Restrict file system permissions on the MobaXterm installation directory to prevent non-administrative users from writing files
• Run MobaXterm from a directory where users do not have write access
• Implement application control policies to prevent loading of unsigned or untrusted DLLs
• Use Windows Defender Application Control (WDAC) or AppLocker to enforce DLL signing requirements

# Example: Restrict permissions on MobaXterm directory (Windows PowerShell)
# Run as Administrator
$acl = Get-Acl "C:\Program Files (x86)\Mobatek\MobaXterm"
$acl.SetAccessRuleProtection($true, $false)
$adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$usersRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Users","ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
$acl.AddAccessRule($adminRule)
$acl.AddAccessRule($systemRule)
$acl.AddAccessRule($usersRule)
Set-Acl "C:\Program Files (x86)\Mobatek\MobaXterm" $acl