{"id":"CVE-2026-96408","published":"2026-10-07T11:17:20.620","lastModified":"2026-10-07T18:17:32.210","description":"A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.","cvssScore":9.4,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://jvn.jp/en/jp/JVN91153973/","tags":[]},{"url":"https://movabletype.org/news/2026/10/mt-930-released.html","tags":[]},{"url":"https://www.sixapart.jp/movabletype/news/2026/10/07-1100.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A code injection vulnerability exists in the upgrade script of Movable Type, allowing unauthenticated attackers to execute arbitrary Perl scripts or SQL queries, potentially leading to full system compromise.","exploitability":"Exploitation is relatively straightforward as it requires no authentication, and the attacker can execute arbitrary code via the upgrade script.","blast_radius":"If exploited, this vulnerability could result in full control of the affected system, including data theft, service disruption, and further propagation of attacks.","remediation":"Disable the upgrade script functionality or ensure it is properly secured to prevent unauthorized execution.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","perl","sql","unauth"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:40:57.000Z"}}