CVE Intelligence
Analysis AI-assisted

CVE-2026-25776: Six Apart Movable Type Code Injection (CWE-94) Allowing Arbitrary Perl Script Execution

Movable Type from Six Apart Ltd. contains a code injection weakness classified as CWE-94 that may allow an attacker to execute arbitrary Perl script. JPCERT/CC provides a CVSS 3.0 base score of 9.8 (Critical), and CISA KEV does not list this CVE. Affected products and fixed versions should be confirmed against the vendor advisory.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Movable Type, a publishing platform from Six Apart Ltd., has a code injection weakness (CWE-94) that may allow an attacker to execute arbitrary Perl script. The record was published on 2026-04-08 and analyzed with JPCERT/CC as the CNA.

Impact

  • JPCERT/CC provides a CVSS 3.0 base score of 9.8 (Critical) with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • A CVSS 4.0 score of 9.3 is also listed in the record.
  • SSVC marks technical impact as total and automatable as yes.

Affected products and versions

  • Movable Type, Movable Type Advanced, Movable Type Premium, Movable Type Premium (Advanced Edition) and Movable Type Premium (MT8-based) are listed.
  • The record lists version ranges that include 9.1.0 and earlier, 9.0.6 and earlier, 8.8.2 and earlier, 8.0.9 and earlier, and 2.14 and earlier for several products.
  • The affected entries are mixed and partly overlapping, so the vendor advisory should be used as the authoritative reference.

Exploitation status

  • This CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted.
  • SSVC exploitation is recorded as none.
  • The record gives an EPSS probability of 0.01004 and a percentile of 0.62633.

Remediation and mitigation

  • The record contains no fixed version field. Review the Six Apart advisory and the Movable Type release note.
  • Prioritize upgrading to a version the vendor marks as fixed. The release note URL refers to 9.0.7, but its content was not verified here.
  • Until patched, restrict access to administrative interfaces and maintain verified backups in line with your organization's policy.

Detection guidance

  • Review web server and application logs for unusual requests to Movable Type administrative and dynamic endpoints.
  • Monitor for unexpected changes to templates, plugins or scripts on the server.
  • Inventory all Movable Type instances, including Premium editions, since they are listed as separate products.

Limitations of the available information

  • The record does not give the fixed version or detailed exploitation conditions.
  • The vendor advisory and the JVN page were not fetched, so their content is not verified.
  • The EPSS date in the record (2026-10-23) is later than the publication date and should be treated with caution.

Frequently asked questions

What is CVE-2026-25776?

It is a code injection vulnerability (CWE-94) in Six Apart Movable Type that may allow an attacker to execute arbitrary Perl script.

How severe is it?

JPCERT/CC provides a CVSS 3.0 base score of 9.8 (Critical). The record also lists a CVSS 4.0 score of 9.3.

Is it being actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.