Review reviewCritical

CVE-2026-25776

Six Apart Ltd. Movable Type, Movable Type Advanced, Movable Type Premium

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.

PRIORITY ASSESSMENT

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.47%

Technical severityCVSS 9.3

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.

Product: Six Apart Ltd. Movable Type, Movable Type Advanced, Movable Type Premium
Affected versions: >= 9.1.0 and earlier, >= 9.0.6 and earlier, >= 8.8.2 and earlier, >= 8.0.9 and earlier, >= 2.14 and earlier, >= 5.1 to 5.18, >= 5.2, >= 5.2.1 to 5.2.13, >= 6.0, >= 6.0.1 to 6.8.8, >= 7 r.4207 to r.5510, >= 8.4.0 to 8.4.4, >= 1.0 to 1.68, <= 2.14, 9.0.5, 9.0.6, 9.1.0, >= 8.0.2 < 8.0.10, >= 8.8.0 < 8.8.3, >= 9.0.1 < 9.0.7
Fixed versions: 8.0.10, 8.8.3, 9.0.7

Confirm exposure before applying a vendor-supported change.

1
Identify
Confirm that Six Apart Ltd. Movable Type, Movable Type Advanced, Movable Type Premium and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE: CWE-94