Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

What’s new: A public exploit has been released for a pre-authentication remote code execution vulnerability (CVE-2026-61511) in vBulletin, affecting versions 6.2.1 and earlier, and 6.1.6 and earlier. The flaw allows unauthenticated attackers to execute code on unpatched servers using PHP’s eval() function. vBulletin released security patches for affected versions on June 30, 2026, and version 6.2.2 on July 1, 2026. The exploit was disclosed on July 27, 2026, but no active exploitation has been reported.

Who’s affected

Administrators running self-hosted installations of vBulletin versions 6.2.1 and earlier, and 6.1.6 and earlier are at risk if they have not applied the patches or upgraded to version 6.2.2. vBulletin Cloud sites have already been patched.

What to do

• Apply the security patches for your version of vBulletin or upgrade to version 6.2.2 immediately.
• Monitor for POST requests with unusual patterns in the pagenav[pagenumber] values, particularly those that are long or operator-heavy.

Sources

• The Hacker News