Is CVE-2026-117687 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-117687 being exploited in the wild.

How severe is CVE-2026-117687?

High severity, with a CVSS score of 7.3, published 12 November 2026.

Which products and versions are affected?

Six Apart Ltd. Movable Type 8.8.6 and earlier (8.8.x series), 8.0.13 and earlier (8.0.x series), 8.4.x, 7.x; Six Apart Ltd. Movable Type Advanced 8.8.6 and earlier (8.8.x series), 8.0.13 and earlier (8.0.x series); Six Apart Ltd. Movable Type Premium 2.18 and earlier (2.x series, including Advanced Edition).

How is CVE-2026-117687 attacked?

It is attacked over the network.

Am I affected by CVE-2026-117687?

Check whether you run Six Apart Ltd. Movable Type, Six Apart Ltd. Movable Type Advanced or Six Apart Ltd. Movable Type Premium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-117687: Movable Type code injection in Dynamic Publishing

CVE-2026-117687 · Severity: high · CVSS 7.3 · Published 2026-11-12

Movable Type is a content management system used to publish websites and manage blog content. A vulnerability in its Dynamic Publishing feature allows attackers to execute arbitrary PHP code by sending specially crafted requests, potentially compromising the entire web server and all data hosted on it.

Technologies: Six Apart Ltd. Movable Type Premium. Vendors: Six Apart Ltd..

Quick answers

Is CVE-2026-117687 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-117687 being exploited in the wild.
How severe is CVE-2026-117687?: High severity, with a CVSS score of 7.3, published 12 November 2026.
Which products and versions are affected?: Six Apart Ltd. Movable Type 8.8.6 and earlier (8.8.x series), 8.0.13 and earlier (8.0.x series), 8.4.x, 7.x; Six Apart Ltd. Movable Type Advanced 8.8.6 and earlier (8.8.x series), 8.0.13 and earlier (8.0.x series); Six Apart Ltd. Movable Type Premium 2.18 and earlier (2.x series, including Advanced Edition).
Is there a fix for CVE-2026-117687?: Yes: fixed in Movable Type 8.8.7, 8.0.14; Movable Type Premium 2.19. Until then: Set the DynamicTemplateAllowPHP environment variable to 0 to prevent the execution of PHP code embedded in design templates. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-117687 attacked?: It is attacked over the network.
Am I affected by CVE-2026-117687?: Check whether you run Six Apart Ltd. Movable Type, Six Apart Ltd. Movable Type Advanced or Six Apart Ltd. Movable Type Premium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Movable Type 8.8.7, 8.0.14; Movable Type Premium 2.19

Set the DynamicTemplateAllowPHP environment variable to 0 to prevent the execution of PHP code embedded in design templates.

Technical details

Code injection vulnerability (CWE-94) in the Dynamic Publishing functionality where PHP code embedded in template processing results is executed for specific MT tags, modifiers, and error display processing. No authentication is required; exploitation requires only the ability to send a specially crafted network request. A fix is available in released versions.

Affected products

Six Apart Ltd. Movable Type 8.8.6 and earlier (8.8.x series), 8.0.13 and earlier (8.0.x series), 8.4.x, 7.x
Six Apart Ltd. Movable Type Advanced 8.8.6 and earlier (8.8.x series), 8.0.13 and earlier (8.0.x series)
Six Apart Ltd. Movable Type Premium 2.18 and earlier (2.x series, including Advanced Edition)

Timeline

2026-11-11: disclosed
2026-11-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.