Is CVE-2026-61511 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61511 being exploited in the wild.

How severe is CVE-2026-61511?

Critical severity, with a CVSS score of 9.8, published 27 July 2026.

Which products and versions are affected?

Vbulletin 5.0.0 through 5.7.5, 6.0.0 through 6.2.1.

Is there a fix for CVE-2026-61511?

A patch was published on 2026-06-30: Security patch released for 6.2.1, 6.2.0, and 6.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61511 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61511?

Check whether you run Vbulletin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61511: vBulletin eval injection in vB5_Template_Runtime::runMaths

CVE-2026-61511 · Severity: critical · CVSS 9.8 · Published 2026-07-27

vBulletin, a widely used internet forum software, contains a critical security flaw that allows unauthorized individuals to take complete control of the server. By sending a specially crafted web request to a specific page navigation component, an attacker can execute malicious commands without needing a username or password. This could lead to the theft of user data, website defacement, or a total service shutdown.

Technologies: Vbulletin. Vendors: Vbulletin.

Quick answers

Is CVE-2026-61511 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61511 being exploited in the wild.
How severe is CVE-2026-61511?: Critical severity, with a CVSS score of 9.8, published 27 July 2026.
Which products and versions are affected?: Vbulletin 5.0.0 through 5.7.5, 6.0.0 through 6.2.1.
Is there a fix for CVE-2026-61511?: A patch was published on 2026-06-30: Security patch released for 6.2.1, 6.2.0, and 6.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61511 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61511?: Check whether you run Vbulletin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An eval injection vulnerability exists in the vB5_Template_Runtime::runMaths() method within vBulletin's template engine. The root cause is an insufficiently restrictive regular expression filter in /includes/vb5/template/runtime.php that intended to permit only mathematical operators and digits but failed to block 'phpfuck-style' encoding. An unauthenticated remote attacker can exploit this by sending crafted input via the 'pagenav[pagenumber]' parameter through the 'ajax/render' template route. This allows the attacker to bypass the regex filter and execute arbitrary PHP code with the privileges of the web server. The issue is resolved in vBulletin version 6.2.2 and via security patches for older supported versions.

Affected products

vBulletin vBulletin 5.0.0 through 5.7.5, 6.0.0 through 6.2.1

Timeline

2026-06-25: disclosed: Vendor notified by SSD Secure Disclosure
2026-06-30: patched: Security patch released for 6.2.1, 6.2.0, and 6.1.6
2026-07-01: patched: Version 6.2.2 released
2026-07-27: advisory: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.