Affected Systems
vBulletin 6.2.1 and earlier, 6.1.6 and earlier. Fixed in version 6.2.2 (released July 1, 2026) and patches for 6.2.1, 6.2.0, 6.1.6. vBulletin Cloud already patched. CVE-2026-61511 assigned but no NVD record or CVSS score available yet.
Exploitation Status
Public PoC released July 27, 2026. No confirmed in-the-wild exploitation as of that date; not listed in CISA KEV catalog. Patch released June 2026, creating a 4-week window of unknown exploitation status. PoC contains trivial typo but is easily corrected.
Business Impact
Self-hosted vBulletin forums that have not patched since late June face unauthenticated remote code execution via the template engine. Attackers can execute arbitrary PHP and OS commands without credentials or user interaction by sending crafted POST requests to ajax/render/pagenav. vBulletin Cloud customers are already protected. CVSS score not yet published by NVD. Risk is highest for internet-facing, unpatched self-hosted installations; vBulletin has a history of similar template-engine RCE flaws exploited shortly after disclosure.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade self-hosted vBulletin installations to version 6.2.2 or apply the vendor-supplied patches for 6.2.1, 6.2.0, or 6.1.6.
- Review web server and application logs for POST requests to ajax/render/pagenav with unusually long or operator-heavy pagenav[pagenumber] parameter values since late June 2026.
- Verify vBulletin Cloud customers are on patched versions; no action required if confirmed.
- Monitor vBulletin security advisories and apply future patches promptly, given the product's history of template-engine RCE vulnerabilities.
- Consider placing unpatched internet-facing vBulletin forums behind a WAF with rules blocking suspicious POST payloads to /ajax/render/ endpoints until patching is complete.