Reported by 2 outlets

Timeline

1. original reporting

   CVE-2026-61511: vBulletin Preauth RCE with Public PoC

   securityonline.info · 79d ago · July 27th, 2026

   A public proof-of-concept exploit has been released for CVE-2026-61511, a critical pre-authentication remote code execution vulnerability in vBulletin 6.x forum software. The flaw resides in the runMaths() method in vBulletin's template runtime, which passes weakly filtered input into a PHP eval() call. An unauthenticated attacker can reach this code through the ajax/render route by sending a tainted page-number parameter that flows into a {vb:math} tag.

   Key details:

   • Affects vBulletin 6.2.1 and earlier, plus 6.1.6 and earlier

   • No authentication or user interaction required

   • Public PoC by researcher EgiX through SSD Secure Disclosure

   • Patch available in vBulletin 6.2.2

   • No confirmed in-the-wild exploitation at time of reporting

   With the exploit code now public, vBulletin forums that remain unpatched are at imminent risk of automated scanning and compromise.

   Action: Identify any internet-exposed vBulletin 6.x instances and immediately upgrade to 6.2.2. Apply the security patch for 6.2.1/6.2.0/6.1.6 branches where full upgrade is not immediately feasible.

   ---

2. mentioned by bleepingcomputer.com

   vBulletin CVE-2026-61511: Patch Released for Pre-Auth RCE with Public Exploit

   bleepingcomputer.com · 77d ago · July 29th, 2026

3. mentioned by

   vBulletin CVE-2026-61511: Patch Released (see Threat Actor section above for details)

   · 77d ago · July 29th, 2026