VulnerabilityBleeping Computer
9.8 — CRITICAL
vBulletin fixes critical pre-auth RCE flaw with public exploit
A critical vulnerability in the vBulletin forum software allows unauthenticated attackers to execute arbitrary PHP code through template rendering. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A critical pre-auth RCE flaw was discovered in vBulletin forum software, allowing unauthenticated attackers to execute arbitrary PHP code through template rendering, with a CVSS score of 9.8 (CRITICAL). The vulnerability affects versions up to 5.7.5 and 6.2.1.
⚙️Technical Details
Affected Systems
vBulletin forum softwarevBulletin versions in the 5.x and 6.x branches
Attack Vectors
template renderingunauthenticated remote attackers exploiting the 'runMaths()' function
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
Users of vBulletin forum software versions up to 5.7.5 and 6.2.1, particularly those with internet-facing servers.
🛡️Recommended Actions
1Apply the latest security patch (version 6.2.2) as soon as possible
2Disable template rendering for untrusted users or content
3Monitor server logs and system commands for suspicious activity
📦Affected Products
vBulletin forum software
🔐NVD Verified DataVERIFIED
CVE-2026-61511 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-95
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.