CVE-2026-25776

CVE-2026-25776 is a code injection vulnerability affecting Movable Type, a content management platform provided by Six Apart Ltd., that allows unauthenticated attackers to execute arbitrary Perl scripts on vulnerable systems. The vulnerability has a CVSS score of 9.8 (Critical) with a network-based attack vector requiring no special privileges or user interaction, making it easily exploitable from the internet. The flaw provides complete compromise of confidentiality, integrity, and availability across affected systems. Currently, there is no evidence of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. While the FAUCET Risk Score of 55.0 indicates moderate community attention, the combination of critical severity and lack of active exploitation suggests this remains a threat requiring immediate patching before widespread attack campaigns emerge.