Which versions of Movable Type are affected by CVE-2026-25776?

Movable Type CMS versions prior to 9.0.7 contain a critical unauthenticated code injection vulnerability (CVE-2026-25776, CVSS 9.3) that enables remote attackers to execute arbitrary Perl code and…

How to fix or mitigate CVE-2026-25776?

Within 24 hours: identify all Movable Type instances in production and staging environments and document current versions. Within 7 days: upgrade all instances to Movable Type 9.0.7 or later as released by Six Apart; test in non-production environment first. Within 30 days: verify successful deployment across all systems, confirm patch application via version checking, and document completion in change management system.

Movable Type CVE-2026-25776

Q: What is the CVSS score of CVE-2026-25776?

CVE-2026-25776 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20132 CRITICAL

Code Injection (CWE-94)

2026-04-08 vultures@jpcert.or.jp

GHSA-mx97-3vf8-2r7p

Code Injection RCE Movable Type

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 17:52 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 09:22 euvd

EUVD-2026-20132

Analysis Generated

Apr 08, 2026 - 09:22 vuln.today

CVE Published

Apr 08, 2026 - 09:16 nvd

CRITICAL 9.3

DescriptionCVE.org

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.

AnalysisAI

Code injection in Movable Type CMS allows unauthenticated remote attackers to execute arbitrary Perl code with critical impact. The CVSS:4.0 score of 9.3 reflects network-accessible exploitation requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), enabling complete system compromise. No public exploit identified at time of analysis, though EPSS data unavailable. Vendor Six Apart has released patched version MT 9.0.7 addressing this CWE-94 code injection flaw.

Technical ContextAI

Movable Type is a Perl-based content management system and blogging platform developed by Six Apart Ltd. This vulnerability represents a CWE-94 code injection flaw, where insufficient input validation or sanitization allows attackers to inject and execute arbitrary Perl code within the application context. Code injection vulnerabilities differ from command injection by allowing execution of code in the application's own runtime environment rather than external system commands. In Perl applications, this typically occurs when user-controlled input is passed to dangerous functions like eval() or similar constructs without proper validation. The vulnerability affects the core CMS platform, potentially impacting all functionality running within the Movable Type installation including content management, template processing, and administrative functions.

RemediationAI

Immediately upgrade to Movable Type version 9.0.7 or later as documented in the vendor security release at https://movabletype.org/news/2026/04/mt-907-released.html and https://www.sixapart.jp/movabletype/news/2026/04/08-1100.html. The vendor-released patch in MT 9.0.7 addresses the underlying code injection vulnerability. Given the unauthenticated remote exploitation vector and critical CVSS score, prioritize emergency patching for all internet-facing installations. If immediate patching is not feasible, consider temporary mitigation by restricting network access to Movable Type administrative interfaces through IP allowlisting or placing the application behind VPN until patching can be completed. Review application logs for suspicious Perl execution patterns or unexpected administrative actions that could indicate reconnaissance or exploitation attempts. No workarounds are documented as substitutes for patching.