What is the CVSS score of CVE-2026-96408?

CVE-2026-96408 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.6%.

How to fix or mitigate CVE-2026-96408?

Within 24 hours, inventory every Movable Type, Movable Type Premium, and Six Apart Cloud Edition instance across the estate and confirm with the vendor which Cloud Edition regions or tenants are affected, then block network access to the upgrade handler at the load balancer, reverse proxy, WAF, or host firewall so it is not reachable from the internet or untrusted networks, and remove or rename the upgrade script on any on-premises installation that has already completed its upgrade. Within 7 days, deploy WAF or reverse-proxy virtual-patch signatures that reject external requests to the upgrade endpoint, restrict it to localhost or an administrative VPN segment with MFA, reduce the privileges of the database account and service account used by the installation to the minimum required, review web and database logs going back at least 30 days for anomalous requests or unexpected SQL and Perl execution, and open a support case with Six Apart to obtain a remediation timeline or hotfix for on-premises and Cloud Edition deployments. Within 30 days, apply the vendor-released patch to all affected versions as soon as it is published and validate through re-scanning, make removal or restriction of the upgrade script a standing post-installation hardening requirement in the build standard, add file-integrity monitoring and alerting on the CMS webroot and its database accounts, and update the incident response playbook and risk register to reflect this exposure.

Movable Type CVE-2026-96408

EUVD-2026-94281 CRITICAL

Code Injection (CWE-94)

2026-10-07 jpcert

GHSA-9xxq-384j-m3qw

RCE Code Injection Movable Type Movable Type Premium Six Apart Ltd Movable Type Cloud Edition Movable Type Premium Cloud Edition

9.3

CVSS 4.0 · Vendor: jpcert

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach upgrade script endpoint over network
Delivery

Submit crafted code-injection payload
Exploit

Script evaluates attacker Perl/SQL
Execution

Execute arbitrary code on server
Impact

Compromise CMS and database

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The vulnerability is located in Movable Type's upgrade script, so exploitation requires that the upgrade/installation script endpoint (e.g., the mt-upgrade CGI handler) be network-reachable by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is needed once that endpoint is reachable, affecting Movable Type, Movable Type Premium, and their Cloud Editions. The primary LIMITING factor is endpoint exposure: deployments that restrict, remove, or firewall the upgrade script after installation substantially reduce reachability, whereas installations leaving the upgrade handler publicly accessible are directly exploitable.
Impact	All signals point to a genuine high-priority issue rather than an inflated CVSS score. The provided CVSS:3.0 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the CWE-94 code-injection class aligns with the description's claim of arbitrary Perl/SQL execution - the stated base score of 9.4 is consistent with C:H/I:H/A:L. However, several real-world risk modifiers are MISSING from the input and must be acknowledged: no EPSS exploitation-probability score was provided, no SSVC decision data (automatable/technical-impact) was supplied, there is no CISA KEV listing, and no public POC is referenced. Therefore the 9.4 reflects theoretical worst-case impact, not demonstrated mass exploitation. One nuance to verify: the flaw resides specifically in the 'upgrade script,' which in many Movable Type deployments (mt-upgrade.cgi) is only reachable during/after an upgrade or when the upgrade endpoint is exposed - this could materially lower real reachability versus the AV:N/PR:N vector, so defenders should confirm whether the upgrade endpoint is publicly accessible in their deployment. Net: treat as high priority for patching given unauthenticated RCE potential, but note exploitation probability is unquantified due to absent EPSS/KEV/POC data.
Exploit ScenarioDerived	A remote, unauthenticated attacker reaches the Movable Type upgrade script endpoint over the network and submits crafted input that the script evaluates as code, injecting arbitrary Perl or an SQL query. This yields server-side code execution and database manipulation without any credentials or user interaction. No public exploit code is referenced in the provided data, so this scenario is derived from the CVSS vector and CWE-94 classification rather than a confirmed POC.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 07, 2026

Unauthenticated code injection in the upgrade script shipped with Movable Type allows a remote attacker to execute an arbitrary Perl script or run an SQL query against the affected installation once the upgrade handler is reachable over the network. The flaw affects Movable Type, Movable Type Premium, and their Cloud Editions (Six Apart), and carries a critical severity rating (vendor CVSS 9.4; our assessment scores availability impact as High rather than Low, yielding CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, but the practical prerequisite is exposure of the installation/upgrade endpoint: sites that remove, restrict, or firewall the upgrade script after installation are substantially less reachable, while sites leaving it publicly accessible are directly exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the immediate risk is driven by mass internet exposure of the endpoint rather than by observed attacks.

RemediationAI

The primary fix is to upgrade to the patched Movable Type release identified in the vendor advisories - consult https://www.sixapart.jp/movabletype/news/2026/10/07-1100.html and the release announcement at https://movabletype.org/news/2026/10/mt-930-released.html (which corresponds to the MT 9.30 line) and the JVN page https://jvn.jp/en/jp/JVN91153973/ to confirm the exact fixed version for your specific edition (Standard, Premium, or Cloud), since the fixed-version data available here is at the product-line level and should not be used to guess a version number. If immediate patching is not possible, the highest-value compensating control is to eliminate reachability of the upgrade/installer CGI handler: delete or rename the upgrade script on production servers, or restrict it at the web server or reverse proxy so that only localhost or an administrative IP range can reach it (for example, an Apache/IIS location-level allow-list or a deny rule scoped to the upgrade CGI path). The trade-off is that the script becomes unavailable for legitimate future upgrades, so this control must be reverted deliberately when an upgrade window is scheduled. Do not rely on authentication as a mitigation: the vector is PR:N, so the endpoint being reachable is the only barrier. Network-layer controls (firewall rules or WAF signatures blocking requests to the upgrade handler) reduce but do not remove risk if the endpoint is still served, and because the injected code runs with the web server and database credentials, containment also means rotating the database password used by Movable Type and reviewing server-side Perl access if the script has been exposed to untrusted networks. Cloud Edition and Premium Cloud Edition customers cannot self-mitigate the handler and should confirm patch status with Six Apart support directly.

Affected VersionsENISA

Movable Type 8.0.0 ≤8.0.12

Movable Type 8.8.0 ≤8.8.5

Movable Type 9.0.0 ≤9.0.9

Movable Type Cloud Edition 9.2.0 ≤9.2.1

Movable Type Premium Cloud Edition 9.2.0 ≤9.2.1

Movable Type Premium 9.0.0 ≤9.0.9

Movable Type Premium 2.0 ≤2.17

Affected Packages

euvd movable_type no fix

euvd movable_type_cloud_edition no fix

euvd movable_type_premium no fix

euvd movable_type_premium_cloud_edition no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a CWE-94 improper control of code generation (code injection) rooted in Movable Type's upgrade/installer script - the legacy Perl CGI component used to migrate or initialize an installation, commonly exposed as an mt-upgrade-style handler. Rather than simply trusting its inputs, that script apparently passes attacker-controllable data into an interpreter with executable semantics, allowing an attacker to supply arbitrary Perl that the web server's Perl runtime will evaluate, or to inject an SQL statement that the application's database handle will run with the installation's own credentials. Because the code runs inside the Movable Type CGI process, the attacker inherits the privileges of the web server account and the database user configured for the blog platform, which is why the impact is broad (high confidentiality and integrity) and, per our independent assessment, potentially full loss of availability as well. The relevant technology stack is Perl/CGI on the server side with a MySQL/PostgreSQL-class backend database, and the affected product family is identified by CPE as Six Apart's Movable Type, Movable Type Premium, Movable Type Cloud Edition, and Movable Type Premium Cloud Edition (cpe:2.3:a:six_apart_ltd.:movable_type*, all versions). The JPCERT-coordinated report and the corresponding JVN advisory (JVN91153973) confirm the vendor-side disclosure context, and the presence of both self-hosted and Cloud Edition CPEs indicates the same code path is shared between the downloadable product and the hosted variants.

Know when Movable Type gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (jpcert) PRIMARY 9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

vuln.today AI 9.8 CRITICAL

Upgrade-script code injection is remotely reachable and unauthenticated (AV:N/PR:N), low-complexity, and arbitrary Perl/SQL execution grants full server and database control (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Oct 07, 2026 - 11:22 NVD

9.4 (CRITICAL) 9.3 (CRITICAL)

CVE Published

Oct 07, 2026 - 10:18 cve.org

CRITICAL 9.4

DescriptionCVE.org

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Executive ViewAI

Why It Matters

Six Apart's Movable Type, Movable Type Premium, and their hosted Cloud Editions contain a critical, unauthenticated code-injection flaw in the post-installation upgrade handler that can let an outside party run arbitrary code or database queries on the affected platform. Any organization publishing public-facing content on these products should treat it as a potential full compromise of the CMS tier - and, through stored credentials and database connections, as a pivot point toward internal systems - until the exposed handler is closed off. The complication is that no vendor fix is available yet, so the immediate burden falls on our teams to reduce reachability rather than to patch.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: block, firewall, or remove the network-reachable upgrade script after installation so the handler is not externally accessible; restrict the endpoint to localhost or an administrative VPN with MFA; apply WAF/reverse-proxy virtual patching that rejects external requests to the upgrade path; run the service and its database account with least privilege to limit code-execution and SQL impact; enable file-integrity monitoring on the webroot and alert on anomalous SQL or Perl activity; and escalate Cloud Edition exposure to Six Apart for vendor-side remediation.

Threat Intelligence Overview

EPSS Score

0.6%

Top 51% exploitable

Prevalence

Medium

established CMS, widely used in Japan, not globally ubiquitous

Social Media

Sightings

Data Quality

3 sources

Confidence: Low

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.6%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.