PT-2026-33412 · Mobatek · Mobaxterm Home Edition

Haehanse · CVE-2026-6421 · Published 2026-03-12 · Updated 2026-04-17

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mobatek MobaXterm Home Edition versions prior to 26.2

Description An issue exists in the msimg32.dll library that allows for an uncontrolled search path. This requires local access and is characterized by high complexity and difficult exploitability.

Recommendations Upgrade to version 26.2.

Exploit

Fix

Uncontrolled Search Path Element

Untrusted Search Path

Weakness Enumeration

CWE-427

CWE-426

Related Identifiers

BDU:2026-09305

CVE-2026-6421

Affected Products

Mobaxterm Home Edition

References · 11

• 🔥 https://drive.google.com/file/d/17bbNDzfoD3NNPlUMkSYs8bVzVbbwddnU/view · Exploit
• https://download.mobatek.net/2622026032581854/MobaXterm_Installer_v26.2.zip · Patch
• https://bdu.fstec.ru/vul/2026-09305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6421 · Security Note
• https://twitter.com/CVEnew/status/2045102603793473725 · Twitter Post
• https://github.com/1neptune/chimera/tree/main · Note
• https://vuldb.com/vuln/358020/cti · Note
• https://vuldb.com/vuln/358020 · Note
• https://mobaxterm.mobatek.net/download-home-edition.html · Note
• https://vuldb.com/submit/778851 · Note
• https://github.com/1neptune/chimera · Note