CVE-2026-61511: vBulletin Template Engine — Pre-Auth Code Execution Exploit (July 2026)

CVE-2026-61511 — vBulletin Template Engine

CVE-2026-61511 is a high-severity vulnerability in vBulletin’s template engine, allowing unauthenticated remote code execution (RCE) via the ajax/render/pagenav route. The flaw is actively exploitable, with a public exploit released on July 27, 2026. vBulletin addressed the issue in version 6.2.2, but unpatched servers remain at critical risk.

Attack Vector

Attackers can send crafted HTTP requests to the ajax/render/pagenav endpoint on vulnerable vBulletin installations. No authentication is required; successful exploitation grants arbitrary code execution on the underlying server. This enables full system compromise, lateral movement, and potential deployment of malware or web shells. The exploit leverages improper input validation in the template engine, making exploitation trivial for attackers with network access.

Who Is at Risk

All self-hosted vBulletin forums running versions prior to 6.2.2 are vulnerable. Organizations using unmanaged or outdated vBulletin deployments are at immediate risk, especially if their forums are exposed to the internet. No specific organizations have been named as compromised, but the global vBulletin user base is affected.

Patch & Mitigate

• Patch: Upgrade to vBulletin 6.2.2 without delay. This version fully addresses CVE-2026-61511.
• Workaround: No official workaround is available; patching is mandatory.
• Detect: Monitor server logs for suspicious requests to /ajax/render/pagenav, especially from unfamiliar IPs. Look for anomalous POST or GET activity and unexpected system processes spawned by the web server user.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit the pre-auth RCE to gain a foothold on exposed servers.
• TA0005 — Defense Evasion: Post-exploitation, adversaries may deploy web shells or modify logs to maintain persistence and evade detection.

Source: https://www.hendryadrian.com/public-exploit-released-for-patched-vbulletin-pre-auth-code-execution-flaw/