Critical Pre-Auth RCE Flaw Enables Remote Code Execution

A critical pre-authentication remote code execution vulnerability in vBulletin forum software allows unauthenticated attackers to execute arbitrary PHP code on affected servers. The flaw, tracked as CVE-2026-61511, impacts versions 5.7.5 and earlier in the 5.x branch, plus versions 6.2.1 and earlier in the 6.x branch. A public proof-of-concept exploit is already available, making immediate patching essential.

What Happened: vBulletin Pre-Auth RCE Flaw Exposes Forum Servers

Independent security researcher Egidio Romano discovered a dangerous vulnerability in vBulletin’s template rendering engine. The flaw resides in the runMaths() function within /includes/vb5/template/runtime.php. This function is supposed to evaluate mathematical expressions only. However, it fails to properly sanitize user input before passing it to PHP’s eval() function.

Consequently, unauthenticated attackers can exploit the vulnerability by sending a specially crafted request to the ajax/render/[template] endpoint. The request triggers a vulnerable template such as pagenav, which ultimately passes attacker-controlled input to eval(), resulting in full remote code execution on the web server. SSD Secure Disclosure published a full proof-of-concept exploit on July 27, 2026, lowering the barrier for attackers significantly.

Technical Details of the vBulletin RCE Vulnerability

The root cause is a flawed input validation regex in the runMaths() method. The regex #([^+\-*=/\(\)\d\^<>&|\.]*)# is intended to strip all non-mathematical characters. However, it permits digits, parentheses, math operators, and binary operators like XOR. Attackers can leverage so-called “phpfuck” techniques to encode arbitrary PHP function names and parameters using only these allowed characters.

The attack chain works as follows:

• The attacker sends a POST request to ajax/render/pagenav
• The pagenav[pagenumber] parameter is assigned to the pagenav.currentpage template variable
• This variable is passed into a {vb:math} tag, which calls runMaths()
• The sanitized but still dangerous input reaches eval()
• Arbitrary PHP code executes, giving the attacker a shell

Attack Prerequisites and Affected Components

The vulnerability requires no authentication. An internet-facing vBulletin instance running an unpatched version is sufficient. The attack does not need elevated privileges, user interaction, or special configuration. The only prerequisite is that the server must be reachable over the network.

Business and Operational Impact

vBulletin is a long-standing PHP-based forum platform released in 2000. It powers large online communities, gaming sites, support portals, automotive forums, and tech discussion boards. Although newer alternatives have gained market share, vBulletin retains a significant installed base.

The impact of CVE-2026-61511 is severe and immediate:

• Full server compromise: Attackers gain remote code execution as the web server user
• Data theft: Forum databases, user credentials, and private messages are at risk
• Malware deployment: Compromised servers can host phishing pages or distribute malware
• Reputation damage: Community trust erodes when forums are defaced or breached
• Compliance violations: Exposure of user PII may trigger GDPR, CCPA, or other regulatory obligations

Furthermore, the May 2025 exploitation of two prior critical vBulletin flaws demonstrates that threat actors actively scan for and exploit these vulnerabilities at scale. The public PoC for CVE-2026-61511 will almost certainly accelerate similar campaigns.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Upgrade immediately to vBulletin 6.2.2 or apply Patch Level 1 for supported 6.x versions (6.2.1, 6.2.0, and 6.1.6)
2. Block external access to /ajax/render/ endpoints at the web server or WAF layer as a temporary stopgap
3. Audit server logs for suspicious POST requests to ajax/render/pagenav or other template routes
4. Rotate credentials for forum admin accounts, database connections, and any API keys stored on the server
5. Scan for indicators of compromise such as unexpected files in web directories or new cron jobs

Additional Hardening Steps

Administrators should also consider longer-term improvements. Moving the forum behind a web application firewall adds an extra layer of defense against exploitation. Disabling unnecessary template rendering routes reduces the attack surface. Finally, running vBulletin in a restricted environment with minimal file system permissions limits the damage from a successful exploit.

Bottom line: With a public exploit already circulating, every unpatched vBulletin instance is a sitting duck. Upgrade now or take the forum offline until you can.

Incident Summary

CVE ID / Incident:	CVE-2026-61511
Affected Systems:	vBulletin 5.7.5 and earlier (5.x branch); vBulletin 6.2.1 and earlier (6.x branch)
Disclosure Date:	July 27, 2026 (public disclosure)
Patch Status:	vBulletin 6.2.2 released July 1, 2026; Patch Level 1 backported to 6.2.1, 6.2.0, and 6.1.6. No patches for 5.x branch.
Severity:	Critical — pre-authentication remote code execution
Exploit Status:	Public PoC available
Researcher:	Egidio Romano (discovered via SSD Secure Disclosure)

References

1. Bill Toulas, “vBulletin fixes critical pre-auth RCE flaw with public exploit,” BleepingComputer, July 28, 2026, https://www.bleepingcomputer.com/news/security/vbulletin-fixes-critical-pre-auth-rce-flaw-with-public-exploit/, accessed July 28, 2026.
2. Egidio Romano, “vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability,” Karmainsecurity.com, July 27, 2026, https://karmainsecurity.com/KIS-2026-13, accessed July 28, 2026.
3. SSD Secure Disclosure, “vBulletin Runtime Template runMaths Preauth RCE,” SSD-Disclosure.com, July 27, 2026, https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/, accessed July 28, 2026.
4. Wayne Luke, “Security patch released for vBulletin 6.2.1, 6.2.0 and 6.1.6,” vBulletin Forums, June 30, 2026, https://forum.vbulletin.com/…/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6, accessed July 28, 2026.
5. NIST National Vulnerability Database, “CVE-2026-61511,” NVD, https://nvd.nist.gov/vuln/detail/CVE-2026-61511, accessed July 28, 2026.