CVE-2026-25866Disclosure(mobatek / mobaxterm)

LOWCVSS 8.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.

mobatek CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-428

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mobaxterm

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-03-09); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

mobatek

Products

mobaxterm

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-09	2	Disclosure2
2026-05-13	1	Disclosure1

Full discourse3 posts

Spektion@spektion148d
Disclosure
CVE-2026-25866: surfaced 33 days before public disclosure, based on behavior. Six slides on the workflow change runtime makes possible: https://www.linkedin.com/posts/spektion_negative-seven-days-when-cves-become-a-trailing-activity-7460358249108889600-Yc2Z?utm_source=share&utm_medium=member_desktop&rcm=ACoAAC92ZaYBOADExOVOy1eCs38p7xaq5AJIrmg
Post summary
CVE-2026-25866 was identified 33 days before public disclosure, with a linked slide deck highlighting a workflow‑change runtime, but no PoC, exploit code, patch, or detailed technical data is provided.
0001040
12 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds213d
Disclosure
CVE-2026-25866 MobaXterm Local Privilege Escalation via Uncontrolled Search Path Element https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25866
Post summary
The snippet announces a local privilege escalation vulnerability in MobaXterm involving an uncontrolled search path element, but lacks detailed technical or exploit information.
0001044
4.0K followersView on X
CVE@CVEnew213d
Disclosure
CVE-2026-25866 MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualifi… https://www.cve.org/CVERecord?id=CVE-2026-25866
Post summary
The post announces CVE‑2026‑25866 as an uncontrolled search path element flaw in MobaXterm (versions before 26.1) with technical details, but does not share a PoC, exploit, exploitation evidence, or patching guidance.
0000089
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mobatek	mobaxterm	-	-	-

Explore more

Back to dashboard mobatek CVEs mobaxterm vulnerabilities