CVE-2026-96408

State: Published
Severity: 9.3 Critical
Published: Oct 7, 2026
Updated: Oct 7, 2026
Reserved: Oct 2, 2026

Description

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	jpcert
3.0	9.4 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	jpcert

Weaknesses

CWE-94 Code injection

Affected Products

Product	Versions
Movable Type Cloud EditionSix Apart Ltd.	9.2.0 through 9.2.1Affected
Movable TypeSix Apart Ltd.	9.0.0 through 9.0.9Affected 8.8.0 through 8.8.5Affected 8.0.0 through 8.0.12Affected
Movable Type Premium Cloud EditionSix Apart Ltd.	9.2.0 through 9.2.1Affected
Movable Type PremiumSix Apart Ltd.	9.0.0 through 9.0.9Affected 2.0 through 2.17Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.