CVE-2026-61511PoC

CRITICALCVSS 9.3 · CRITICAL

Exploitation observed; activity peaked at 15 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

Back to dashboard

8.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-95

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 3 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
51 mentions across 18 observed days

What's happening

Active exploitation reported across 3 signals
Exploit tool or code specified in 14 signals
PoC mentioned or linked in 32 signals
Patch or workaround mentioned in 24 signals
Technical details provided in 48 signals
Disclosure: 11 classified signals
Peaked 17d ago at 15 mentions (2026-07-27); latest day: 1
51 total mentions across 18 days

Deep dive

Activity timeline51 mentions / 18d

Signal classification6 categories

PoC

1632.0%

Patch

1326.0%

Disclosure

1122.0%

Exploit

612.0%

Active Exploitation

36.0%

General

12.0%

Referenced assets35 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-27	15	Active Exploitation1Disclosure3Exploit2Patch4PoC5
2026-07-28	12	Disclosure3Exploit3Patch2PoC4
2026-07-29	7	Active Exploitation1Disclosure1Exploit1Patch3PoC1
2026-07-30	1	Patch1
2026-07-31	1	Patch1
2026-08-01	2	Disclosure1PoC1
2026-08-02	1	Disclosure1
2026-08-04	2	Patch1PoC1
2026-08-08	1	PoC1
2026-08-13	1	Patch1
2026-08-24	1	Disclosure1
2026-08-27	1	Active Exploitation1
2026-08-29	1	General1
2026-09-02	1	PoC1
2026-09-13	1	Disclosure1
2026-09-15	1	PoC1
2026-10-11	1	PoC1

Full discourse20 posts

FOFA@fofabot90d
PoC
⚠️⚠️ CVE-2026-61511 (CVSS 9.8): vBulletin pre-auth RCE — weak runMaths() filter → PHP eval via ajax/render/pagenav (pagenav[pagenumber]). Affects 5.x–5.7.5 and 6.x–6.2.1. Patch to 6.2.2 or vendor security patches. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJ2QnVsbGV0aW4i 🎯11.1K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="vBulletin" PoC: https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/ 🔖Refer: https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/ #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The post announces a high‑severity pre‑authentication RCE in vBulletin, supplies a PoC link, indicates a patch exists, but does not report active exploitation.
210033123.1K
14.8K followersView on X
pdnuclei-bot@pdnuclei_bot63d
Disclosure
🚨 CVE-2026-61511 - critical 🚨 vBulletin 6.x - Remote Code Execution > vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection vulnerabi... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-61511 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet alerts to a critical CVE-2026-61511 remote code execution flaw in vBulletin, includes a link to a detection template, but does not mention exploitation or patches.
013030131.9K
1.3K followersView on X
xer0dayz@xer0dayz86d
PoC
CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per. https://sn1persecurity.com/wordpress/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per/ #CVE-2026-61511 #bugbounty #redteam #offsec #netsec #infosec #poc https://t.co/JxdGQfBs0G
Post summary
The tweet highlights a critical unauthenticated RCE in vBulletin, provides a Nuclei detection template, and links to a Sn1per page, indicating a PoC is publicly available.
01102781.4K
8.4K followersView on X
Rıdvan Yağlı@ridvanyagli15d
PoC
vBulletin'in bazı sürümlerini etkileyen Pre-Auth RCE açığı (CVE-2026-61511) için PoC'ler: https://github.com/HORKimhab/CVE-2026-61511 https://github.com/codeb0ssx/Ultimate-CVE-2026-61511 https://github.com/tc4dy/CVE-2026-61511-PoC-Exploit
Post summary
The post describes a pre-authentication RCE affecting some vBulletin versions and shares links to PoCs. It does not mention active exploitation or remediation.
13022101.8K
2.5K followersView on X
YogSotho@YogSoth089d
Disclosure
🚨🚨🚨🚨 # CVE-2026-61511 #vBulletin RCE Exploit Kit CVE-2026-61511 is an unauthenticated Remote Code Execution vulnerability in vBulletin forums affecting versions 5.0.0-5.7.5 and 6.0.0-6.2.1. Look who's back 😎 BrokenSec® #0days #exploit #RCE #CVE #security #hacking #cybersecurityawareness #infosec #antisec #cybernews
Post summary
The tweet announces a new unauthenticated RCE vulnerability in vBulletin (CVE‑2026‑61511) and references an exploit kit but provides no patches, exploit code, or evidence of active exploitation.
3502061.0K
1.9K followersView on X
elhacker.NET@elhackernet90d
Patch
Fallo crítico de vBulletin permite ejecución remota de código PHP vBulletin ha corregido la vulnerabilidad CVE-2026-61511 , un fallo crítico de ejecución remota de código https://blog.elhacker.net/2026/07/fallo-critico-de-vbulletin-permite.html
Post summary
The blog post announces that vBulletin has fixed the critical CVE-2026-61511, a remote code execution vulnerability in PHP.
0702344.6K
141.9K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi89d
Patch
ياقدمي vBulletin 😅 احد هنا يذكره ؟ المهم اذا فيه احد يستخدم منتدياتهم للان ( مع اني ماعتقد😓 ) حدث نسختك بسبب وجود ثغره رقمها CVE-2026-61511 تقييمها 9.8 CRITICAL https://t.co/DKkTrtFHaT
Post summary
The tweet alerts to a critical CVE-2026-61511 affecting vBulletin and advises users to update their installations.
72110919.4K
50.2K followersView on X
elhacker.NET@elhackernet88d
Patch
vBulletin soluciona vulnerabilidad crítica de RCE previa a la autenticación con exploit público Se ha detectado una vulnerabilidad crítica (CVE-2026-61511) en el software de foros vBulletin (versiones 5.x y 6.x) https://blog.elhacker.net/2026/07/vbulletin-soluciona-vulnerabilidad.html
Post summary
vBulletin has identified and patched a critical unauthenticated RCE vulnerability (CVE-2026-61511) affecting versions 5.x and 6.x, with a public exploit documented and a fix available.
0702014.3K
142.4K followersView on X
ThreatWire@ThreatWire_84d
Disclosure
🚨 CVE-2026-61511: A critical unauthenticated RCE vulnerability affects vBulletin 5.x/6.x via runMaths eval injection. #vBulletin #RCE #CVE #CyberSecurity
Post summary
The post announces a critical unauthenticated RCE vulnerability (CVE-2026-61511) affecting vBulletin 5.x/6.x, exploiting eval injection in the runMaths component.
1201542.7K
1.7K followersView on X
ZoomEye@zoomeye_team90d
Disclosure
🚨 CVE-2026-61511: vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php Critical Vulnerability Alert! vBulletin is affected by CVE-2026-61511. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-61511 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-61511" Search Dork: title="vBulletin" Exposure: 3.7k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=dGl0bGU9InZCdWxsZXRpbiI=&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260728 #Infosec #CyberSecurity #ZoomEye #DarkEye
Post summary
The tweet announces CVE-2026-61511, a critical eval injection RCE in vBulletin, linking to a detailed analysis but providing no PoC, exploit code, patch, or evidence of active exploitation.
0401432.4K
12.7K followersView on X
Netlas.io@Netlas_io91d
PoC
CVE-2026-61511: Pre-auth RCE vulnerability in vBulletin, 9.3 rating 🔥 The vulnerability allows unauthenticated attacker to run arbitrary PHP code as the web server, which can mean full site takeover. PoC is now available! 👉 https://nt.ls/c7BPf
Post summary
A Proof of Concept for CVE-2026-61511 is provided, demonstrating a pre‑authentication RCE in vBulletin that permits arbitrary PHP execution on the web server.
040851.7K
7.7K followersView on X
Es Geeks@EsGeeks90d
PoC
🚨 PoC público de RCE pre-auth en vBulletin (CVE-2026-61511). Sin login, sin interacción, eval() de PHP al alcance. Parche desde el 1 de julio. Si tienes foro self-hosted → actualiza YA. #ciberseguridad #vbulletin #RCE https://t.co/28cB9Ctt1U
Post summary
A public proof‑of‑concept for a pre‑authentication RCE in vBulletin (CVE‑2026‑61511) is available, with a patch released on July 1. Users of self‑hosted forums are urged to update immediately.
110112784
22.4K followersView on X
Daily CyberSecurity@Daily_CyberSec91d
PoC
A public PoC now targets CVE-2026-61511, a vBulletin preauth RCE via runMaths eval. Patch to vBulletin 6.2.2 to block remote code execution. #vBulletin #CVE202661511 #RCE #PreauthRCE #RemoteCodeExecution #PoC #WebSecurity #Cybersecurity http://securityonline.info/vbulletin-preauth-rce-cve-2026-61511/
Post summary
The post announces a public PoC for CVE‑2026‑61511, confirms a patch to vBulletin 6.2.2 is available, and provides technical details but no evidence of active exploitation.
04053699
13.0K followersView on X
Previdian@PrevidianCyber60d
Active Exploitation
🚨 CVE-2026-61511 is now hitting Previdian sensors. Critical vBulletin pre-auth RCE: Jul 27 → disclosure + PoC Aug 25 → Nuclei template Aug 27 → exploitation attempts matching it The PoC sat public for a month. Two days after the template landed, the traffic followed. https://t.co/jVHbIeq8k4
Post summary
The tweet reports CVE-2026-61511, a critical pre-auth RCE in vBulletin, noting a public PoC released in July, a Nuclei template on Aug 25, and exploitation attempts observed on Aug 27, indicating active exploitation in the wild.
12050269
147 followersView on X
Autumn Good@autumn_good_3591d
Disclosure
🚨🚨🚨 重大な脆弱性が出るたびに過去何度も世界中で漏えい祭りになったvBulletinで認証不要のRCE... CVE-2026-61511 vBulletin Runtime Template runMaths Preauth RCE https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/
Post summary
A new vBulletin RCE vulnerability (CVE-2026-61511) allowing unauthenticated exploitation has been disclosed, with technical details and a link to the full disclosure.
00152751
7.1K followersView on X
Cloudflare Changelog@CFchangelog74d
Patch
New WAF rule blocks the vBulletin RCE vulnerability CVE-2026-61511. Also improved detection for version control leaks and vBulletin image injection. https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/
Post summary
Cloudflare released a new WAF rule to block the vBulletin RCE vulnerability CVE-2026-61511, effectively providing a mitigation for the flaw.
00051984
6.1K followersView on X
yousukezan@yousukezan91d
PoC
vBulletinで、認証不要で任意のPHPコードを実行できるリモートコード実行の脆弱性「CVE-2026-61511」の公開PoCが公開された。脆弱性はvBulletin 6.2.2で修正済みだが、未更新の環境は攻撃対象となる可能性がある。この脆弱性はテンプレート処理のrunMaths()メソッドに存在する。入力値を十分に検証しないままPHPのeval()へ渡しており、数字や括弧、演算子、XOR演算子などを利用して任意のPHPコードを組み立てて実行できる。攻撃は認証不要で、ajax/renderルートから送信した細工済みのpage番号パラメータが{vb:math}タグを経由してeval()に到達することで成立する。SSD Secure Disclosureは、この攻撃経路の詳細とともに、研究者EgiXが作成した動作するPoCを公開した。影響を受けるのはvBulletin 6.2.1以前および6.1.6以前のバージョンで、両系統とも同じテンプレート処理コードを共有している。現時点では実際の悪用は確認されていない。対策として、vBulletin 6.2.2へのアップデートが推奨されており、旧バージョンを利用している場合は6.2.1、6.2.0、6.1.6向けに提供されたセキュリティパッチを適用することで脆弱性を解消できる。 https://securityonline.info/vbulletin-preauth-rce-cve-2026-61511/
Post summary
A Proof of Concept for CVE‑2026‑61511, enabling pre‑auth remote code execution in vBulletin via eval in the runMaths() template method, has been publicly released, but no active exploitation has been reported. Patches and updates to vBulletin 6.2.2 and earlier versions are available to mitigate the flaw.
000421.5K
15.0K followersView on X
ROOTCAUSE@rootcausehq90d
Disclosure
CVSS 9.3: vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 let unauthenticated attackers execute arbitrary PHP via the pagenav[pagenumber] parameter. Eval injection in the template runtime's runMaths() method. https://nvd.nist.gov/vuln/detail/CVE-2026-61511 #cve #exploit https://t.co/TSim1T6srS
Post summary
The text discloses a critical vulnerability (CVSS 9.3) in vBulletin that permits unauthenticated attackers to execute arbitrary PHP through an eval injection in the template runtime.
0102285
566 followersView on X
xer0dayz@xer0dayz41d
PoC
CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per. https://sn1persecurity.com/wordpress/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per/ #CVE-2026-61511 #bugbounty #redteam #offsec #netsec #infosec #poc https://t.co/XS2HnzAVUx
Post summary
The post describes a pre-authentication RCE in vBulletin and promotes a Nuclei detection template with a #poc hashtag, making the main takeaway the availability of a PoC/detection artifact. No active exploitation, patch, or debunking claims are present.
01012348
8.4K followersView on X
Attack Surface Management | Sn1perSecurity@Sn1perSecurity2d
CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per. https://sn1persecurity.com/wordpress/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per/ #CVE-2026-61511 #bugbounty #redteam #offsec #netsec #infosec #poc https://t.co/zHCD8A6TWq
00012145
1.9K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-61511

FOFA[verified]@fofabotPoC

The post announces a high‑severity pre‑authentication RCE in vBulletin, supplies a PoC link, indicates a patch exists, but does not report active exploitation.

Rıdvan Yağlı[verified]@ridvanyagliPoC

The post describes a pre-authentication RCE affecting some vBulletin versions and shares links to PoCs. It does not mention active exploitation or remediation.

YogSotho[verified]@YogSoth0Disclosure

The tweet announces a new unauthenticated RCE vulnerability in vBulletin (CVE‑2026‑61511) and references an exploit kit but provides no patches, exploit code, or evidence of active exploitation.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediPatch

The tweet alerts to a critical CVE-2026-61511 affecting vBulletin and advises users to update their installations.

ThreatWire[verified]@ThreatWire_Disclosure

The post announces a critical unauthenticated RCE vulnerability (CVE-2026-61511) affecting vBulletin 5.x/6.x, exploiting eval injection in the runMaths component.

ZoomEye[verified]@zoomeye_teamDisclosure

The tweet announces CVE-2026-61511, a critical eval injection RCE in vBulletin, linking to a detailed analysis but providing no PoC, exploit code, patch, or evidence of active exploitation.

Netlas.io[verified]@Netlas_ioPoC

A Proof of Concept for CVE-2026-61511 is provided, demonstrating a pre‑authentication RCE in vBulletin that permits arbitrary PHP execution on the web server.

Cloudflare Changelog[verified]@CFchangelogPatch

Cloudflare released a new WAF rule to block the vBulletin RCE vulnerability CVE-2026-61511, effectively providing a mitigation for the flaw.