Public Exploit Details Expose Patched vBulletin Pre-Auth RCE

Summary

A July 27 public exploit details CVE-2026-61511, an unauthenticated vBulletin template-engine RCE already patched in affected branches and vBulletin 6.2.2. No in-the-wild attacks were confirmed; exposure remains on unpatched self-hosted forums.

Key points

• CVE-2026-61511 affects vBulletin’s template engine and can enable unauthenticated remote code execution on unpatched servers.
• The exploit chain passes visitor-controlled input from the public ajax/render/pagenav route into vB5_Template_Runtime::runMaths(), which sends filtered input to PHP’s eval().
• SSD lists vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, as affected, without specifying a lower version boundary.
• The vendor released branch patches in late June and vBulletin 6.2.2 on July 1, before public exploit details appeared on July 27; vBulletin says its Cloud sites are patched.
• The published proof-of-concept has a one-character typo that prevents it from running unchanged. A local test with the typo corrected confirmed the expression-building flaw, not an attack on a live server.
• The article reports no confirmed in-the-wild exploitation as of July 27, 2026, and says the vulnerability was not listed in CISA’s Known Exploited Vulnerabilities catalog.
• Administrators are advised to patch or upgrade self-hosted installations; monitoring unusually long or operator-heavy pagenav[pagenumber] values in ajax/render/pagenav requests is suggested based on the PoC.

MITRE ATT&CK

CVE

People

Products