CVE-2026-33088

Movable Type, a content management system provided by Six Apart Ltd., contains a critical SQL injection vulnerability (CVE-2026-33088) that permits unauthenticated attackers to execute arbitrary SQL statements against affected installations. The vulnerability presents a CVSS 3.1 score of 9.8 (CRITICAL), reflecting its network-accessible nature, low attack complexity, and lack of required authentication or user interaction. Exploitation could result in complete compromise of system confidentiality, integrity, and availability, enabling attackers to extract sensitive data, modify or delete database contents, and potentially escalate privileges. Although the exploit probability (EPSS) is currently low at 0.000360000, the vulnerability is listed on CISA's Known Exploited Vulnerabilities Catalog as ACTIVE and included on the Hot List, indicating active exploitation attempts in the wild. Organizations running affected versions of Movable Type should prioritize immediate patching and implement network segmentation controls to limit exposure while updates are deployed.