CVE-2026-96408

critical · 9.3

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

9.3

CVSS

0.4%

EPSS (exploit prob.)

36th

EPSS percentile

2026-10-07

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-94

References

https://jvn.jp/en/jp/JVN91153973/
https://movabletype.org/news/2026/10/mt-930-released.html
https://www.sixapart.jp/movabletype/news/2026/10/07-1100.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-96408