by Kastro
Paper/Archive/CVE-2026-25776

CVE-2026-25776

Six Apart Ltd. Movable Type — Movable Type provided by Six Apart Ltd.

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.0.510 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.

Affected

ProductAffectedFixed inSource
Movable Type9.1.0 and earlier–CNA
Movable Type9.0.6 and earlier–CNA
Movable Type8.8.2 and earlier–CNA
Movable Type8.0.9 and earlier–CNA
Movable Type Advanced9.1.0 and earlier–CNA
Movable Type Advanced9.0.6 and earlier–CNA
Movable Type Advanced8.8.2 and earlier–CNA
Movable Type Advanced8.0.9 and earlier–CNA
Movable Type Premium9.1.0 and earlier–CNA
Movable Type Premium9.0.6 and earlier–CNA
Movable Type Premium Advanced Edition9.1.0 and earlier–CNA
Movable Type Premium Advanced Edition9.0.6 and earlier–CNA

Scores by source

jpcert (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
jpcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmovabletype.org/news/2026/04/mt-907-released.htmlrefsixapart.jp/movabletype/news/2026/04/08-1100.htmlrefjvn.jp/en/jp/JVN66473735