CVE-2026-61511

This is a serious security bug in vBulletin that can let an attacker run instructions on your server without needing an account. Think of it like leaving a “run code” door unlocked on your website: someone can use crafted input to make the server execute attacker commands. If someone successfully exploits it, the attacker may be able to fully control the server hosting your forum, not just change the pages users see.

This matters if you run the vBulletin forum software and your version is older than 6.2.2. The issue does not require a login or a user to click anything, meaning it can be attempted by anyone who can reach the vulnerable endpoint(s) on your server. When vBulletin is reachable from the internet and the relevant render/template route is exposed, it becomes a risk.

This should be treated as urgent because it is a pre-authentication remote code execution bug—attackers can try it without logging in. Even though no in-the-wild exploitation is confirmed in the findings, a public exploit was disclosed, which increases the chance of fast abuse. Given this is marked RED, upgrade to 6.2.2 or block the vulnerable endpoint immediately if you can’t upgrade right away.

1. Confirm exposure (version + service)

   • Log into your vBulletin admin area (or check your vBulletin installation files) and record the exact version.
   • Determine whether your site is reachable from the public internet.

2. Confirm affected versions

   • The findings state this applies to vBulletin versions up to 6.2.1 (and 5.x through 5.7.5) and is fixed in 6.2.2.

3. Apply the fix

   • Upgrade vBulletin to 6.2.2 or later.
   • After upgrading, re-check the displayed version to confirm it is 6.2.2.

4. Temporary mitigation if you must delay patching

   • Use a firewall/WAF (or reverse proxy rules) to block or tightly restrict public access to the template rendering route referenced in the findings: ajax/render/[template].
   • If you host behind a load balancer or edge security, apply the rule at the edge so the vulnerable request never reaches the application.

5. Validation after changes

   • Ensure normal forum functionality still works for your users.
   • Confirm that requests to the blocked render/template endpoint are denied (for example, by checking edge/WAF logs).

6. What to monitor

   • Review web server and WAF logs for repeated requests targeting ajax/render/[template] (especially unusual or high-rate attempts) before and after the change.

CVE-2026-61511 is a CWE-95 (eval injection) vulnerability in vBulletin < 6.2.2. The mechanism is improper sanitization in the vB5_Template_Runtime::runMaths() template processing logic, where attacker-controlled input can reach PHP’s eval() and execute arbitrary PHP code. The findings specifically reference exploitation via the unauthenticated ajax/render/[template] endpoint. Authentication is not required and user interaction is none. Public exploit disclosure was reported on July 27, 2026, but the findings state no in-the-wild exploitation had been confirmed as of that date. The fixed version provided by the findings is vBulletin 6.2.2. KEV listing was not present in the provided findings. Predicted EPSS is provided in the findings, but exploitation confirmation in the findings takes precedence for urgency.