CVE-2026-61511

This is a serious security bug in vBulletin that can let an attacker run instructions on your server without needing an account. Think of it like leaving a “run code” door unlocked on your website: someone can use crafted input to make the server execute attacker commands. If someone successfully exploits it, the attacker may be able to fully control the server hosting your forum, not just change the pages users see.

This matters if you run the vBulletin forum software and your version is older than 6.2.2. The issue does not require a login or a user to click anything, meaning it can be attempted by anyone who can reach the vulnerable endpoint(s) on your server. When vBulletin is reachable from the internet and the relevant render/template route is exposed, it becomes a risk.

This should be treated as urgent because it is a pre-authentication remote code execution bug—attackers can try it without logging in. Even though no in-the-wild exploitation is confirmed in the findings, a public exploit was disclosed, which increases the chance of fast abuse. Given this is marked RED, upgrade to 6.2.2 or block the vulnerable endpoint immediately if you can’t upgrade right away.