Vulnerability details
CVE-2026-96408
Six Apart Movable TypeSix Apart Movable Type Premium
CVSS 4.0
9.3Critical
Official description
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (jpcert) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
| 9.4Critical | 3.0 | CVEProject cvelistV5 (CNA) (jpcert) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Six Apart Ltd. | Movable Type | 8.0.0 ≤ v ≤ 8.0.12 | CVEProject cvelistV5 (CNA) |
| Six Apart Ltd. | Movable Type | 8.8.0 ≤ v ≤ 8.8.5 | CVEProject cvelistV5 (CNA) |
| Six Apart Ltd. | Movable Type | 9.0.0 ≤ v ≤ 9.0.9 | CVEProject cvelistV5 (CNA) |
| Six Apart Ltd. | Movable Type Cloud Edition | 9.2.0 ≤ v ≤ 9.2.1 | CVEProject cvelistV5 (CNA) |
| Six Apart Ltd. | Movable Type Premium | 2.0 ≤ v ≤ 2.17 | CVEProject cvelistV5 (CNA) |
| Six Apart Ltd. | Movable Type Premium | 9.0.0 ≤ v ≤ 9.0.9 | CVEProject cvelistV5 (CNA) |
| Six Apart Ltd. | Movable Type Premium Cloud Edition | 9.2.0 ≤ v ≤ 9.2.1 | CVEProject cvelistV5 (CNA) |
References and advisories
3
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-07
- Last updated
- 2026-10-07
- State
- Published
- Assigner (CNA)
- jpcert
Exploit prediction (EPSS)
0.41%
Probability of exploitation in 30 days
36.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-94Code injection