Movable Type Vulnerability JVN#91153973: Update or Mitigate Now

On 7 October 2026, Japan's IPA and JPCERT/CC announced vulnerabilities (JVN#91153973) in Movable Type, software for building websites. The most serious has a severity of 9.4 (Critical): someone who is not logged in may be able to run programs on your server.

On top of that, security support for Movable Type 8.0 ended on 5 November. This article is for companies that run their website on Movable Type: how to check your version, how to update, what to do if you can't update right away, and how to look for signs of an attack. Sites you have left entirely to a web agency are included.

What is the flaw, and why does it matter?

This fix centres on the two issues below. Both are rated as open to attack over the internet without logging in.

Several other security issues have been fixed as well. They were reported by RyotaK of GMO Flatt Security.

Affected versions and where to move

First, check which branch your site is on.

※ In the cloud edition, automatic updates are turned on by default, so unless you have turned them off, the update has already been applied. If you have turned them off, update soon.

※ To use the latest version of the software edition, your annual maintenance contract needs to be active. If it has expired, check Six Apart's guidance.

Timeline

• 8 April 2026
  JVN#66473735 published. Weak spots in the admin screen and the Data API, severity 9.8 (Critical). Fixed in 9.0.7, 8.8.3, 8.0.10 and others
• 7 October 2026
  JVN#91153973 published. 9.3.0, 9.0.10, 8.8.6 and 8.0.13 released
• 26 October 2026
  9.3.1 and 9.0.11 released, fixing problems found in 9.3.0 and 9.0.10
• 5 November 2026
  Security support for 8.0 ends

Six steps to check and respond

1. Find out who manages your site

   Is it someone in-house, a web agency or a maintenance company? If you don't know, look for your server contract or emails from when the site was built.

2. Check the version

   Sign in to the admin screen; the version is shown somewhere such as near the bottom of the screen. If you can't find it, ask the company that manages the site.

3. Take a backup

   Before updating, save both the site's files and its database.

4. Update to the fixed version

   Six Apart strongly recommends installing the new version in a separate location and switching over, rather than overwriting the old one. After updating, check that your main pages, your contact form and site search work.

5. If you can't update right away, apply the workaround

   Follow "Workarounds if you can't update" below. The same applies to old versions that have no fix.

6. Look for signs of an attack

   Go through the checklist below. If anything looks wrong, change the administrator passwords and consult a specialist company.

Workarounds if you can't update

Six Apart gives the following as temporary measures if you can't update right away. To fix the problem properly, you need to update.

• If you run it as CGI (all versions): delete mt-upgrade.cgi, mt-search.cgi and mt-ftsearch.cgi, or restrict access so they cannot be run from outside
• If you run it under PSGI (6.2 and later, cloud edition): set upgrade, new_search and ft_search in RestrictedPSGIApp in mt-config.cgi (ft_search is for 6.2.4 and later)
• If you run it under PSGI (6.0 and 6.1): set UpgradeScript and SearchScript to a sufficiently long string that cannot be guessed

※ If you stop the search programs, site search will no longer work. Put the upgrade program back the next time you update.

※ On versions older than the fixes for the April vulnerability (9.0.7, 8.8.3, 8.0.10 and others), also apply the workaround given at that time (such as deleting mt-data-api.cgi). That workaround only blocks attacks that go through the Data API, so you still need to update.

How to look for signs of an attack

Neither JVN nor Six Apart has published definitive markers such as the attackers' IP addresses. Check the following.

• Does your access log show requests to mt-upgrade.cgi at times when you were not updating the site yourself?
• Do any requests to mt-search.cgi contain unnaturally long strings or symbols as search terms?
• Are there any administrator accounts you don't recognise, or accounts whose permissions have changed?
• Are there changes or files you don't recognise in your templates or published files?

A request in the log does not necessarily mean someone got in. Treat it as one clue and judge it together with the other items.

If you are on an old version (8.4, 7 and so on)

Unsupported versions get no fixes, so the workaround is only a temporary stopgap. There are two main options.

• Upgrade to a newer version of Movable Type: check your licence and annual maintenance, then move to 8.8 or 9. You will need to check that your plugins and templates work on the new version.
• Move to a different system: depending on the size of the site and how you update it, rebuilding may work out cheaper in the long run.

Which is better depends on the state of your server and how many plugins you use. If the server underneath is also old, see "Securing Legacy Systems: Where to Start", and if you can't reach your web agency, see "Taking Over a Legacy System With No Documentation". If you also have a WordPress site, "WordPress CVE-2026-119977: Update Now" may help too.

If a web agency looks after your site

Even if a web agency looks after your website, the site belongs to your company. It is worth asking them:

• What version is our Movable Type on now? Is it on the fix for JVN#91153973?
• Has the April issue, JVN#66473735, been dealt with too?
• Is the annual maintenance contract still active? In whose name is it?
• Are any of the plugins we use no longer being developed?
• Can we also receive the login details for the admin screen and the server?

Leave it, or act now?

How Digi Dinos can help

Digi Dinos is a company that supports DX, security, and the operation and maintenance of systems. We have offices in Japan and Vietnam, and over 8 years we have delivered more than 150 projects. Our team works in Japanese.

• Movable Type updates and checks: version check, backup, workaround, update, check for traces of an attack.
• Taking over maintenance of existing sites: we can also take over sites that are no longer being updated, or sites built by another company.
• Moving to a new system: we look into whether to upgrade from your old version or rebuild, and propose the cost and timeline together.
• No documentation? No problem: even when the original vendor is gone and nobody understands the system, we read the code, rebuild the documentation and propose a complete plan.
• Lifetime warranty: if a defect turns up in work we did, we fix it, with no time limit for as long as the maintenance contract continues.

Frequently asked questions