Movable Type CVE-2026-25776

Remote unauthenticated attacker can inject arbitrary Perl code into Movable Type by Six Apart Ltd. Default installations are vulnerable. No authentication, user interaction, or special configuration required. Affects all versions with this vulnerability.

This represents a critical-severity vulnerability with genuine real-world risk. The CVSS:4.0 vector confirms unauthenticated remote exploitation (PR:N) with low attack complexity (AC:L) and no user interaction required (UI:N), achieving complete confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). The attack vector is network-based (AV:N), meaning any internet-facing Movable Type installation is potentially vulnerable to remote compromise. While no public exploit identified at time of analysis and KEV status not confirmed, the combination of unauthenticated remote code execution in a widely-deployed CMS platform presents significant risk. The technical impact enables complete system takeover including database access, content manipulation, and potential lateral movement. Organizations should treat this as an immediate patching priority despite absence of confirmed active exploitation, particularly for public-facing installations. The availability of vendor patch MT 9.0.7 provides clear remediation path, making delayed patching indefensible from a risk management perspective.

An unauthenticated remote attacker identifies a public-facing Movable Type installation and crafts malicious HTTP requests containing Perl code injection payloads targeting vulnerable input parameters. Because the vulnerability requires no authentication (PR:N) and has low attack complexity (AC:L), the attacker successfully injects arbitrary Perl code that executes within the application context. This grants the attacker complete control over the CMS, enabling database credential extraction, content defacement, installation of persistent backdoors, or use of the compromised server as a pivot point for lateral movement within the organization's network. The attacker could also modify templates to inject malicious JavaScript affecting all site visitors, or exfiltrate sensitive content and user data stored within the CMS database.