CriticalCritical vulnerability

CVE-2026-96408 (CVSS 9.3)

NVD · officialPublished Oct 7, 2026Risk 50/100

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Technical details

CVSS

9.3

AV:NetworkAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source