license and cve notes

Trust, security and use

MobaXterm is written by Mobatek. This website (mobaxterm.io) is independent. It explains the license, the 26.4 CVE fixes, and what you are responsible for when you run a remote-access client.

Legal usage

Home Edition is free for personal computers. If the binary runs on a company image, a contractor laptop used for paid work, or a shared operations jump box, you need Professional ($69 / 49€ per user on the public price list).

Do not redistribute modified builds as if they were Mobatek's. The Customizer exists so companies can brand a licensed Professional package. Home Edition is not that channel. SSH and SFTP are the protocols Mobatek highlights for remote file and shell access.

Ethical usage

Connect only to hosts you are authorized to manage. A tabbed SSH client with MultiExec and stored passwords is a privilege. Using it to scan networks you do not own, or to keep other people's keys on a shared USB stick, is on you, not on the vendor.

X11-forwarding, RDP and VNC can expose a full desktop. Treat those sessions like a console sitting in the office.

Source transparency

The main MobaXterm executable is proprietary. Mobatek states that sources for third-party plugins and components are published as a separate pack, each under its own license. Plugins you drop beside the exe should come from that channel, not from an unsigned zip on a forum.

This page does not host those source archives and does not link out. Ask the site owner if they later add a local copy.

Malware clarification

We are not claiming a personal VirusTotal run on v26.5. Softonic published a Clean scan note and a SHA-256 for a 26.4 zip. Heuristic alerts on portable exes are common. They are not a substitute for hashing the file you received.

Known issues that are already patched:

CVE-2026-11879 (v26.4): unused libraries no longer loaded at startup by MobaTextEditor, Xorg, MoTTY and Cygwin.
CVE-2026-11967 (v26.4): winspool.drv no longer probed at launch.
CVE-2026-6421 (v26.2): msimg32.dll dependency removed.
CVE-2026-25866 (v26.1): custom text-editor search path.

Run Home Edition v26.5. Older Portable folders on USB sticks are the usual place leftover 25.x builds hide.

Your responsibility

You choose the package URL once the owner fills the # buttons. You choose whether to save passwords, where the INI lives, and which jump hosts you trust. This site is not Mobatek support and does not accept incident reports.

Disclaimer: mobaxterm.io is an independent information and download-placeholder site. Mobatek remains the vendor. MobaXterm is a trademark of Mobatek. Nothing here is a warranty, a license grant, or permission to attack systems you do not own.