CVE-2026-96408: Six Apart Movable Type code injection in upgrade script
CVE-2026-96408 is a code injection flaw in the upgrade script of Six Apart Movable Type, described as allowing an unauthenticated attacker to run an arbitrary Perl script or SQL query. The record lists a critical CVSS 3 base score of 9.4 from JPCERT/CC, but no fixed version or confirmed exploitation appears in the sources consulted. Administrators of the listed Movable Type editions should check the vendor advisory and apply the vendor's update as soon as the fixed release is confirmed.
Overview
CVE-2026-96408 affects the upgrade script of Six Apart Movable Type. The record classifies it as code injection (CWE-94) and states that an unauthenticated attacker may be able to execute an arbitrary Perl script or an SQL query on the affected product. The record was published on 2026-10-07 and its status is Awaiting Analysis.
Impact
- The CVSS 3 vector in the record marks confidentiality and integrity as high and availability as low, with no privileges or user interaction required.
- The JPCERT/CC base score is 9.4 on CVSS 3 and 9.3 on CVSS 4, both rated critical in the record.
- SSVC data in the record rates technical impact as total and automatable as yes.
Affected products and versions
The record lists the following ranges, written with their endpoints:
- Movable Type: from 9.0.0 up to and including 9.0.9; from 8.8.0 up to and including 8.8.5; from 8.0.0 up to and including 8.0.12.
- Movable Type (Cloud Edition): from 9.2.0 up to and including 9.2.1.
- Movable Type Premium: from 9.0.0 up to and including 9.0.9; from 2.0 up to and including 2.17.
- Movable Type Premium (Cloud Edition): from 9.2.0 up to and including 9.2.1.
The record does not list any fixed version. Check the vendor news page and the Movable Type release announcement for the corrected release that applies to your edition.
Exploitation status
The CISA KEV catalog does not list this CVE, and the record contains no confirmed reports of exploitation in the wild. The SSVC exploitation field is none and the EPSS probability is 0.00643. These values are indicators from the record, not evidence that exploitation is absent.
Remediation and mitigation
- Identify every Movable Type and Movable Type Premium instance, including Cloud Edition deployments, and record the exact version of each.
- Follow the JVN advisory and the vendor notices to obtain the corrected release for your edition, and apply it as soon as it is validated in a test environment.
- Until patching is complete, limit network access to administrative and upgrade functions to trusted networks, and remove internet exposure of those functions where operationally possible.
- Take verified backups of the application and database before any upgrade activity.
Detection guidance
- Review web server and application logs for unexpected requests to upgrade or maintenance functions, especially from unknown sources.
- Monitor for unexpected changes to application files, scripts and database content, and for new scheduled tasks or processes created by the web application account.
- Compare file integrity against a known-good baseline after any suspicious activity.
Limitations of the available information
The record gives no fixed version, no patch details, and no exploit or attack-path information beyond the general description. It does not specify which upgrade script path is affected. Confirm the affected components and corrected releases directly with the vendor and JVN before concluding on exposure.
Frequently asked questions
What is the main risk of CVE-2026-96408?
The record describes code injection in the Movable Type upgrade script that may allow an unauthenticated attacker to run a Perl script or SQL query. JPCERT/CC scores it 9.4 on CVSS 3.
Is there a fixed version listed in the record?
No. The record contains no fixed version, so the corrected release must be confirmed with the vendor and the linked advisories.
Is this CVE known to be exploited in the wild?
The CISA KEV catalog does not list it and the sources consulted report no confirmed exploitation. This does not rule out future exploitation.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.