UpHeron
All vulnerabilities

Servers and applications

CVE-2026-96408

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Severity
Critical 9.4
Published
7 Oct 2026
Last changed
7 Oct 2026
Added to UpHeron
3 Nov 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
Movable TypeServers and applications · cna:six apart ltd.|movable type*
  • From 2.0 up to 2.17
  • From 8.0.0 up to 8.0.12
  • From 8.8.0 up to 8.8.5
  • From 9.0.0 up to 9.0.9
  • From 9.2.0 up to 9.2.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-96408