Critical vBulletin RCE Flaw Exposes Forum Servers to Unauthenticated Attacks

Thehackernews

Critical vBulletin RCE Flaw Exposes Forum Servers to Unauthenticated Attacks

First seen 27 Jul 2026, 19:52 UTC • •72.9

Article Content

1 / 12

Browse articles

ThreatCluster •July 28, 2026 at 15:18 UTC

•CVE-2026-61511 allows unauthenticated remote code execution on vBulletin servers.
•Affected versions include vBulletin 6.2.1 and earlier, and 6.1.6 and earlier.
•Public exploit details have been released, increasing the urgency for patching.

A critical remote code execution vulnerability, tracked as CVE-2026-61511, has been disclosed in vBulletin, allowing unauthenticated attackers to execute arbitrary PHP code on vulnerable forum servers. The flaw affects vBulletin versions 6.2.1 and earlier, as well as 6.1.6 and earlier. It exists in the vB5_Template_Runtime::runMaths() method within the runtime.php file. Public exploit details have been released, showing how attackers can reach PHP's eval() function without needing any user interaction. This vulnerability poses a significant risk to unpatched forum installations, as it does not require administrative access. The vulnerability was disclosed by SSD Secure Disclosure on July 27, 2026, and a patch has been issued to mitigate the risk. Administrators are urged to apply the patch immediately to protect their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 74d ago How this analysis works

Timeline

2026-07-27

CVE-2026-61511 published

A critical remote code execution flaw in vBulletin was disclosed, affecting multiple versions.

Cybersecuritynews

2026-07-27

Public exploit details released

Details on how to exploit the vBulletin flaw were made public, showing unauthenticated access methods.

2026-07-27

Patch issued for vBulletin

vBulletin released a patch to address the critical vulnerability, urging immediate application by users.

More articles in this cluster (11)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Organization (1)

VBulletin

Vulnerability (1)

CVE-2026-61511

Weakness (1)

CWE-94 - Code Injection

Affected Platform (1)

PHP

Relationships

CVE-2026-61511 targets PHP
Zero-day Exploit targets PHP
CVE-2026-61511 related to VBulletin
CVE-2026-61511 related to CWE-94 - Code Injection

Following this threat?

Track VBulletin and CVE-2026-61511 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…