[Urgent] Movable Type CVE-2026-96408: Unauthenticated RCE and SQL Execution (CVSS v4.0 9.3) — Update, or Block mt-upgrade.cgi and Related Scripts

Movable Type, the CMS from Six Apart, has a flaw (CVE-2026-96408) that could let an unauthenticated attacker run remote code or arbitrary SQL. A site-search SQL injection (CVE-2026-103668) was fixed at the same time. JVN (the vulnerability portal of JPCERT/CC and IPA) and Six Apart published them on 7 October 2026, and fixed versions (9.3.0, 9.0.10, 8.8.6, 8.0.13) came out the same day.

First, what is known and what is not. The score is CVSS v4.0 9.3 (CRITICAL), and it is JPCERT/CC's rating (NVD, run by NIST, still showed "Awaiting Analysis" when I checked on 12 October). Neither the Six Apart announcement nor JVN says anything about exploitation. Neither CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalog, in the copy I fetched on 12 October (dated 8 October).
CISA's rating recorded in NVD, however, says CVE-2026-96408 is "automatable: yes" with "technical impact: total" (exploitation: none). "Exploitation not confirmed" does not mean "safe". The flaw is reachable from outside without authentication, so update any server that is exposed.

What to do now

• ✓First, check which Movable Type version you run. Check it in the admin screen or in the files on the server (see the product's own guidance for how). If you use the cloud edition with the default auto-update, it has already been updated. Six Apart says those who turned auto-update off on purpose should update soon
• ✓Update to a fixed version. Movable Type (including Advanced): 9.3.0 / 9.0.10 / 8.8.6 / 8.0.13. Movable Type Premium (including Advanced Edition): 9.3.0 / 9.0.10 / 2.18. Go to the fixed version of the series you use (for example 8.8.6 if you are on 8.8)
• ✓If you run an end-of-life (EOL) version, your series has no fixed version. Six Apart says versions 4, 5, 6, 7 and 8.4 and Premium 1 are affected too. You must move to a series that has a fixed release, or apply the mitigation below and stop exposing it
• ✓If you cannot update right away, apply the official mitigation. In a CGI environment, delete mt-upgrade.cgi, mt-search.cgi and mt-ftsearch.cgi, or block access so they cannot be run from outside. PSGI settings are in the next section. Note that blocking mt-search.cgi disables site search (this site's note)
• ✓Check your access logs. No official indicators of compromise have been published. Look for unfamiliar requests to mt-upgrade.cgi, mt-search.cgi or mt-ftsearch.cgi since 7 October (this site's note, not an official procedure)

Affected versions and fixes (from the Six Apart announcement and JVN)

• ▸Movable Type (including Advanced): 9.2.1 and earlier (9.2 series), 9.0.9 and earlier (9.0), 8.8.5 and earlier (8.8), 8.0.12 and earlier (8.0). Fixed in 9.3.0 / 9.0.10 / 8.8.6 / 8.0.13
• ▸Movable Type Premium (including Advanced Edition): 9.2.1 and earlier (9.2), 9.0.9 and earlier (9.0), 2.17 and earlier (8.0 and 8.8 based). Fixed in 9.3.0 / 9.0.10 / 2.18
• ▸Unsupported versions are affected too: Movable Type 4.0 to 4.38, 5.0 to 5.2.13, 6.0 to 6.8.8, 7 r.4207 to r.5510, 8.4.0 to 8.4.4, and Movable Type Premium 1.0 to 1.68. For the mt-search.cgi issue, in the 4 series only 4.3 and later are affected
• ▸Editions: 9.3.0 and 8.8.6 come as cloud, software and AMI editions; 9.0.10 and 8.0.13 as software and AMI editions
• ▸The 8.0 series is out of maintenance, and security support (EOL) runs until 5 November 2026, according to the MovableType.org announcement. If you are on 8.0, plan a migration too

Mitigation if you cannot update (the official guidance)

Six Apart gives mitigation steps for each environment if you cannot update at once. All of them keep the vulnerable scripts out of reach from outside. They are temporary; updating is the only full fix.

• ▸CGI environments (all versions): delete mt-upgrade.cgi, mt-search.cgi and mt-ftsearch.cgi, or restrict access so they cannot be executed. Movable Type 8 and later does not ship mt-ftsearch.cgi, so the file may not exist in your environment
• ▸PSGI environments (Movable Type 6.2 and later, and the cloud edition): set `RestrictedPSGIApp upgrade`, `RestrictedPSGIApp new_search` and `RestrictedPSGIApp ft_search` in mt-config.cgi (`ft_search` needs 6.2.4 or later)
• ▸PSGI environments (Movable Type 6.0 and 6.1): set the environment variables `UpgradeScript` and `SearchScript` to long, unpredictable strings
• ▸After applying it, check that these URLs can no longer be reached from outside (this site's note)

What happened, with dates

• ▸7 October 2026: Six Apart began providing Movable Type 9.3.0 / 9.0.10 / 8.8.6 / 8.0.13 and Premium 9.3.0 / 9.0.10 / 2.18 and announced them as a security update. JVN published the same day (JVN#91153973). The reporter is given as RyotaK of GMO Flatt Security, Inc.
• ▸The same day: CVE-2026-96408 and CVE-2026-103668 were published as CVEs and appeared in NVD. JPCERT/CC assigned the CVSS scores
• ▸12 October (the date of this check): NVD shows both as awaiting analysis, and neither is in the CISA KEV catalog (version dated 8 October 2026)

The two flaws (from the Six Apart announcement)

• ▸CVE-2026-96408 (CVSS v4.0: 9.3 CRITICAL / v3.0: 9.4): code injection in the upgrade script (mt-upgrade.cgi). An unauthenticated attacker may be able to run an arbitrary Perl script or SQL (RCE or arbitrary SQL)
• ▸CVE-2026-103668 (CVSS v4.0: 8.8 HIGH / v3.0: 8.6): SQL injection in site search (mt-search.cgi and mt-ftsearch.cgi). An unauthenticated attacker can run arbitrary SQL, and data including unpublished data may be output
• ▸Several other security issues were also fixed; they are described in each version's release notes (this article covers only the two that were published)

What is known and unknown about exploitation

Known. The Six Apart announcement and JVN describe impact, fixed versions and mitigation. Neither says exploitation has been confirmed. The CISA KEV catalog, in the copy I fetched on 12 October, does not list them. CISA's rating (SSVC) recorded in NVD is "exploitation: none, automatable: yes, technical impact: total" for CVE-2026-96408 and "exploitation: none, automatable: yes, technical impact: partial" for CVE-2026-103668, both dated 7 October.

Unknown. Five days after publication I still cannot confirm from official material whether the flaws are exploited. I also have no source on whether attack code is circulating. It is only days old, and I found no third-party verification. Do not treat the absence of an exploitation note as a reason to wait.

What could not be confirmed

• ▸The detailed conditions for an attack. The sources say the attacker needs no authentication, but not in which configurations the scripts are reachable (for example whether mt-upgrade.cgi is exposed). Use the mitigation check above to see whether yours is reachable
• ▸NVD's scoring. When I checked on 12 October NVD still showed both as awaiting analysis. The 9.3 (v4.0, CRITICAL) in this article is JPCERT/CC's value, and it can change once NIST scores it
• ▸Indicators of compromise. The official material gives no file names or log patterns to look for
• ▸The "several other vulnerabilities". Six Apart points to each release's notes; I did not check them here
• ▸What to do on EOL versions. Some series have no fixed release. The vendor says only "update to a fixed version, or apply the mitigation"

Three lines to share

• ▸Movable Type has an unauthenticated RCE and arbitrary-SQL flaw (CVE-2026-96408, CVSS v4.0 9.3), published on 7 October. A site-search SQL injection (CVE-2026-103668) was fixed with it
• ▸★If you run it yourself, update to 9.3.0 / 9.0.10 / 8.8.6 / 8.0.13 (Premium 9.3.0 / 9.0.10 / 2.18). If you cannot, delete or block mt-upgrade.cgi, mt-search.cgi and mt-ftsearch.cgi (PSGI has its own settings). Unsupported versions are affected too
• ▸The official material does not report exploitation, but that is not "safe". It is not in KEV. Cloud editions with auto-update on are already updated

Sources