CVE-2022-38336

CVE-2022-38336 affects Mobatek MobaXterm prior to 22.1. The issue is an access-control flaw that allows attackers to connect to the server via SSH or SFTP without authentication. Public details describe the root cause as auth bypass in the SSH/SFTP handling; impact is high (unauthorized access). ...

CVE-2021-28847

CVE-2021-28847 affects Mobatek MobaXterm prior to 21.0. A remote attacker can cause a denial of service (Windows GUI hang) by sending rapid, repeated tab title change requests, leading to many SetWindowTextA/SetWindowTextW calls. Exploitation is network-based, with low attack complexity and no us...

CVE-2026-25866

MobaXterm versions prior to 26.1 are affected by an Unquoted Search Path vulnerability. The app uses WinExec to launch Notepad++ without a fully qualified executable path when opening remote files. An attacker can place a malicious executable earlier in the search order, leading to arbitrary code...