CVE-2026-61511: vBulletin ajax/render/template — Pre-auth RCE Threat (June 2026)

CVE-2026-61511 — vBulletin ajax/render/template

CVE-2026-61511 is a critical severity pre-authentication remote code execution (RCE) vulnerability in vBulletin versions up to 5.7.5 and 6.2.1. The flaw allows unauthenticated attackers to execute arbitrary PHP code on affected servers. A public proof-of-concept exploit is available, and active exploitation is highly likely. Immediate patching is required.

Attack Vector

Attackers exploit improper input sanitization in the runMaths() function, accessible via the ajax/render/template endpoint. No authentication is required. By sending crafted requests, an attacker can inject and execute arbitrary PHP code on the server. This can result in full system compromise, data theft, or use of the server in further attacks. There are no specific IOCs published, but log entries showing unexpected POST requests to /ajax/render/template or anomalous PHP execution should be reviewed.

Who Is at Risk

All organizations running vBulletin versions up to 5.7.5 or 6.2.1 are vulnerable, especially those with internet-facing forums. The vulnerability affects both 5.x and 6.x branches. vBulletin itself is affected; no other vendors are listed. Older 5.x users are advised to upgrade, as backports are not available for all legacy versions.

Patch & Mitigate

• Patch: Upgrade immediately to vBulletin 6.2.2 or apply available backports for supported 6.x versions. Older 5.x users must upgrade to a supported release.
• Workaround: No official workaround is available. Restrict access to the ajax/render/template endpoint at the network level if patching is delayed.
• Detect: Monitor web server logs for suspicious or anomalous requests to /ajax/render/template, especially unauthenticated POSTs. Review for unexpected PHP code execution or new files in web directories.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers gain access via a public-facing application exploit.
• TA0007 — Discovery: Successful exploitation may allow attackers to enumerate further assets or credentials post-compromise.

Source: https://www.hendryadrian.com/vbulletin-fixes-critical-pre-auth-rce-flaw-with-public-exploit/