CVE-2026-6421

HIGH

Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-6421. PoCs published by 1neptune.

AI-analyzed exploit summary This repository contains a Rust-based fileless shellcode loader and DLL hijacking exploit for MobaXterm Home Edition <= 26.1 (CVE-2026-6421). The exploit leverages DLL hijacking to execute shellcode downloaded from a remote C2 server, with anti-sandbox detection and stealth techniques to avoid AV detection.

Description

A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 26.2 is able to mitigate this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Exploits (1)

nomisec WORKING POC
by 1neptune · poc
https://github.com/1neptune/chimera

This repository contains a Rust-based fileless shellcode loader and DLL hijacking exploit for MobaXterm Home Edition <= 26.1 (CVE-2026-6421). The exploit leverages DLL hijacking to execute shellcode downloaded from a remote C2 server, with anti-sandbox detection and stealth techniques to avoid AV detection.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: MobaXterm Home Edition <= 26.1
No auth needed
Prerequisites: User must manually start MobaXterm (DLL hijacking opportunity) · Network access to C2 server (zhuyan.cloud) · x86 architecture
mistral-large-3 · analyzed Jul 06, 2026 Full analysis →

References (6)

Core 6
Core References
Vdb Entry vdb-entry
VDB-358020 | Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path
https://vuldb.com/vuln/358020
Signature, Permissions Required signature permissions-required
VDB-358020 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/358020/cti
Third Party Advisory third-party-advisory
Submit #778851 | Mobatek MobaXterm 26.1.0.5456 Uncontrolled Search Path -- DLL hijacking with msimg32.dll
https://vuldb.com/submit/778851

Scores

CVSS v3 7.0
EPSS 0.0015
EPSS Percentile 4.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-426 CWE-427
Status published
Products (3)
Mobatek/MobaXterm Home Edition 26.0
Mobatek/MobaXterm Home Edition 26.1
Mobatek/MobaXterm Home Edition 26.2
Published Apr 17, 2026
Tracked Since Apr 17, 2026