The June 2026 release lands hardware-token SSH login, a smarter SSH browser, deferred UI loading for faster startup, and patches for two public CVEs — here is every change explained.
MobaXterm 26.4 shipped on and is one of the more substantial point releases in recent memory. The headline addition is native smart card certificate authentication over SSH — something power users have requested for years — but there are also meaningful quality-of-life improvements to the SSH browser, measurable startup performance gains, and a handful of security fixes that warrant an immediate upgrade for any team running earlier versions.
This article walks through every confirmed change sourced from the official MobaXterm changelog so you know exactly what you are getting before you update.
What Changed at a Glance
| Change | Category | Impact |
|---|---|---|
| Smart card certificate auth via CryptoAPI | New feature | High |
| Smart card management UI | New feature | High |
| Right-click SSH → open SFTP with same params | New feature | Medium |
| SSH browser location choosable via title icon | New feature | Medium |
| Sessions + SSH browser shown simultaneously | New feature | Medium |
| SSH browser column widths saved/restored | New feature | Low |
| Deferred icon/toolbar creation | Performance | High |
| Deferred checkbox list creation | Performance | Medium |
| Graphical component caching | Performance | Medium |
| CVE-2026-11879 patched | Security | Critical |
| CVE-2026-11967 patched | Security | Critical |
| Clipboard-related terminal freeze fixed | Bug fix | High |
| Underscore rendering at 125% DPI fixed | Bug fix | Medium |
| Multi-monitor 4K DPI blur fixed | Bug fix | Medium |
| OpenSSH, OpenSSL, X server updated | Components | High |
Watch — MobaXterm Tutorial & Overview
Before diving into the details, this walkthrough covers MobaXterm's core features and setup in real-time — worth more than a thousand words of description.
New Features in Depth
1 Smart Card Certificate Authentication
MobaXterm 26.4 adds full smart card support for SSH sessions via the Windows Microsoft CryptoAPI. YubiKeys, PIV cards, CAC cards, and any PKCS#11-compatible hardware token recognised by Windows can now authenticate SSH connections directly inside MobaXterm — no third-party middleware required.
Alongside the authentication hook, there is a new smart card management panel where you can view attached certificates, add or remove entries, and retrieve the corresponding OpenSSH public key string for pasting into ~/.ssh/authorized_keys on your servers.
2 SSH Browser Gets Smarter
The SSH file browser received the most interface work in this release. Four improvements shipped together:
- Right-click → Open SFTP — any SSH session can now spawn a matching SFTP browser with the same host, port, and credentials pre-filled.
- Choosable location via title icon — click the title bar icon to move the SSH browser pane to any position in the layout.
- Simultaneous view — sessions list and SSH browser can now be displayed at the same time without one collapsing the other.
- Persistent column widths — resized columns are saved per-session and restored on reconnect.
The quick tab switching display bug that caused the SSH browser to show stale file listings when flipping between sessions rapidly has also been resolved.
3 Faster Startup and Better Performance
Three targeted optimisations reduce MobaXterm's cold-start time noticeably on machines with many configured sessions.
Deferred icon and toolbar creation — system tray icons and toolbar buttons are now built lazily after the main window is shown, rather than blocking the initial paint. On large session sets this produces a visible improvement.
Deferred checkbox list creation — settings panels with long checkbox lists are populated on first open rather than at startup.
Graphical component caching — frequently redrawn UI elements are cached to reduce redundant GDI operations, which also helps reduce CPU usage during heavy terminal activity.
Security Patches and Bug Fixes
Two CVEs were addressed in this release. CVE-2026-11879 and CVE-2026-11967 are both patched in the 26.4 build. Mobatek has not published full advisory details at the time of writing, but both are listed explicitly in the official changelog and the fix should be treated as a mandatory update for any production or shared environment.
Beyond the CVEs, the following bugs are resolved:
- Clipboard-related terminal freeze — pasting large content blocks could cause the terminal to hang.
- Tab selection double-click — double-clicking a session to open it sometimes failed to select the correct tab.
- SSH browser quick-switch display — rapidly switching tabs showed stale file listings.
- Proxy tunnel password prompt — the password dialog was not appearing correctly when connecting through a proxy tunnel.
- Underscore at 125% DPI — the underscore character was clipped or invisible at non-standard display scaling.
- Multi-monitor 4K blur — windows moved between monitors with different DPI settings appeared blurry.
- SCP browser download — certain file downloads through the SCP browser were failing silently.
- Portable mode temp folder — the portable edition now correctly cleans up its temp folder on exit.
The embedded OpenSSH, OpenSSL, and X server components have all been updated to their latest releases as of June 2026, picking up any upstream security fixes from those projects as well.
How to Download MobaXterm 26.4
MobaXterm 26.4 is a free upgrade for all existing 26.x users. The Home Edition remains free for personal use with up to 12 saved sessions. Visit the downloads page to get the installer or portable edition — the portable version is a single .exe with no installation required, ideal for work machines where you cannot install software.
If you are new to MobaXterm entirely, the getting started guide walks through installation, your first SSH session, and the built-in SFTP file browser.