CVE-2026-96408

CVSS 9.4 (critical) · published 2026-10-07

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Weakness: CWE-94

Source: NVD CVE-2026-96408

References

• https://jvn.jp/en/jp/JVN91153973/
• https://movabletype.org/news/2026/10/mt-930-released.html
• https://www.sixapart.jp/movabletype/news/2026/10/07-1100.html

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.