Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

Summary: Public exploit details released on July 27 show an unauthenticated request reaching PHP's eval() function in vBulletin's template engine, tracked as CVE-2026-61511, affecting versions 6.2.1 and earlier and 6.1.6 and earlier. vBulletin patched those branches at the end of June and released 6.2.2 on July 1, nearly four weeks before the exploit went public, and no in-the-wild attacks were confirmed as of July 27, 2026.
Bottom line: The live exposure sits with self-hosted, internet-facing forums still running unpatched builds - the same population that, in the May 2025 vBulletin template-engine chain (CVE-2025-48827 and CVE-2025-48828), drew exploitation attempts within days of disclosure after many forums never applied a fix issued months earlier.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-61511
Related: ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026