CVE-2026-25776 is a critical code injection vulnerability in Movable Type by Six Apart Ltd., affecting versions 9.1.0 and earlier. The vulnerability permits remote, unauthenticated attackers to execute arbitrary Perl code, potentially leading to full system compromise. The CVSS v3.0 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow attackers to execute arbitrary Perl scripts remotely without authentication, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. This could lead to unauthorized data access, data modification, or denial of service. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected Movable Type installations and monitor for suspicious activity related to Perl script execution. Avoid exposing the service directly to untrusted networks.