Quick answers
- Is CVE-2026-11967 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11967 being exploited in the wild.
- How severe is CVE-2026-11967?
- Informational severity, with a CVSS score of 8.5, published 12 June 2026.
- Which products and versions are affected?
- Mobatek MobaXterm 26.3 (Build 5154).
- Is there a fix for CVE-2026-11967?
- A patch was published on 2026-06-12: Fixed in version 26.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-11967 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-11967?
- Check whether you run Mobatek MobaXterm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A DLL hijacking vulnerability (CWE-427) exists in MobaXterm Personal Edition (Portable) version 26.3 (Build 5154). The application's startup routine utilizes an uncontrolled search path, causing it to attempt to load the 'winspool.drv' library from the application's current working directory before searching secure system paths. An attacker with local file system access can place a malicious DLL with this name alongside the portable executable. When the victim launches the application, the malicious code is executed with the privileges of the user. This has been addressed in version 26.4.
Affected products
- Mobatek MobaXterm Personal Edition (Portable) 26.3 (Build 5154)
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory
- 2026-06-12: patched: Fixed in version 26.4