Vulnerabilities in Movable Type allow remote code execution and data leaks

Lolipop!Security

You must update Movable Type or apply file workarounds due to vulnerabilities that allow remote code execution and data leaks.

Required action

Update Movable Type to a fixed version or version 9.3.0, or delete the target CGI files or change their permissions to 000.

Changes

  • You can update Movable Type (9.0.9 and earlier, 8.8.5 and earlier, 8.0.12 and earlier) and Premium editions to fixed versions
  • Fixed versions are not provided for unsupported versions such as Movable Type 4.x–7.x, 8.4.x, and Premium 1.x
  • If you cannot update immediately, you can delete files like mt-upgrade.cgi or change their permissions to 000
  • Deleting or changing the permissions of mt-search.cgi makes site search unavailable

Affected areas

CVE-2026-96408CVE-2026-103668mt-upgrade.cgimt-search.cgimt-ftsearch.cgi

Open official page

This summary is independently created by Release Radar and is not an official announcement from the vendor. Please read the official page for accurate details.

More updates