What’s Vulnerable › Vulnerabilities

CVE-2026-44392

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-20 · updated 2026-07-24
• Weakness: CWE-862

Description

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.

Affected products

• Six Apart Ltd. Movable Type: through 9.1.1; through 9.0.7; through 8.8.3; through 8.0.10
• Six Apart Ltd. Movable Type Advanced: through 9.0.7; through 8.8.3; through 8.0.10; 9.1.1 and earlie
• Six Apart Ltd. Movable Type Premium: through 9.1.1; through 9.0.7; 2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)
• Six Apart Ltd. Movable Type Premium Advanced Edition: through 9.1.1; through 9.0.7; 2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)

References

• https://jvn.jp/en/jp/JVN66473735/
• https://movabletype.org/news/2026/05/mt-908-released.html
• https://www.sixapart.jp/movabletype/news/2026/05/20-1100.html

Get alerted when CVE-2026-44392 or the next vulnerability affects your stack