Quick answers
- Is CVE-2026-11879 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11879 being exploited in the wild.
- How severe is CVE-2026-11879?
- Informational severity, with a CVSS score of 8.5, published 12 June 2026.
- Which products and versions are affected?
- Mobatek MobaXterm 26.3 (Build 5154).
- Is there a fix for CVE-2026-11879?
- A patch was published on 2026-06-12: Fixed in version 26.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-11879 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-11879?
- Check whether you run Mobatek MobaXterm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A DLL hijacking vulnerability (CWE-427) exists in MobaXterm Personal Edition (Portable) version 26.3. The application's startup routine searches for specific dynamic-link libraries (DLLs) in a predictable temporary directory that is user-modifiable before checking secure system paths. An attacker with local access can place a malicious DLL in this directory to achieve arbitrary code execution with the privileges of the user running the application. This vulnerability has been addressed in version 26.4.
Affected products
- Mobatek MobaXterm Personal Edition (Portable) 26.3 (Build 5154)
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory
- 2026-06-12: patched: Fixed in version 26.4