vBulletin 5.x and 6.x Critical RCE Vulnerability: CVE-2026-61511
vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1 contain a critical eval injection vulnerability (CVE-2026-61511) enabling unauthenticated remote code execution.
What happened
The vulnerability resides in the vB5_Template_Runtime::runMaths() method, allowing attackers to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route. This can be achieved using phpfuck-style encoding with permitted characters, bypassing insufficiently restrictive regex filters.
Although no in-the-wild exploitation has been confirmed as of July 27, 2026, a public exploit was released on the same date. Administrators of self-hosted vBulletin installations should upgrade to the latest patched version (6.2.2) to mitigate the risk.
For those unable to immediately upgrade, it is recommended to review potentially compromised environments for any signs of unauthorized access or suspicious activity. The primary sources should be consulted for the most up-to-date information and technical details.
How 0Day mitigates this
vbulletin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.