Full research report

Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-61511 is a well-documented unauthenticated RCE in vBulletin's template math-processing function, exploitable through a default public route with no credentials required and no victim interaction. The vendor patched the flaw roughly four weeks before SSD's public disclosure, a meaningful head-start that narrows—but does not eliminate—the exposed population. The prior campaign in the same component, CVE-2025-48827 and CVE-2025-48828, saw confirmed attacks within three days of EgiX's May 2025 disclosure, establishing a clear precedent for rapid weaponisation of vBulletin template-engine research. The published PoC's typographic error marginally raises the barrier but does not constitute meaningful protection; the correction is identified within the advisory text itself. The primary residual risk is concentrated in internet-facing self-hosted vBulletin instances that have not yet applied the June 2026 patches or upgraded to 6.2.2, a population that prior disclosure cycles suggest is non-trivial in size.

What happened

On 27 July 2026, SSD Secure Disclosure published a full technical advisory and interactive proof-of-concept for CVE-2026-61511, an unauthenticated remote code execution vulnerability in vBulletin's template engine. vBulletin had silently issued security patches for versions 6.2.1, 6.2.0, and 6.1.6 in late June 2026 and released the clean 6.2.2 build on 1 July 2026, approximately four weeks before public disclosure. The exploit is signed by EgiX (Egidio Romano), the same researcher who disclosed the May 2025 vBulletin template-engine chain; SSD credits an unnamed independent researcher, and the relationship between the two is not publicly stated. No source had confirmed in-the-wild attacks as of the disclosure date.

Affected scope

vBulletin 6.2.1 and earlier and 6.1.6 and earlier on self-hosted installations; vBulletin Cloud is reported as already patched. No lower version boundary is specified by SSD. The vulnerability requires only an internet-facing forum serving the default pagenav template and is reachable without any account or administrative access.

Technical assessment

The vulnerability resides in the vB5_Template_Runtime::runMaths() method in /includes/vb5/template/runtime.php. The method filters user-supplied input before passing it to PHP's eval(), but the filter blocks only alphabetic characters while permitting digits, parentheses, arithmetic and binary operators, including XOR. An attacker can reach this function without authentication via the public route ajax/render/pagenav by supplying a crafted pagenav[pagenumber] value that is embedded in a {vb:math} template tag and passed to runMaths(). Using a restricted-character encoding technique described in the advisory as 'phpfuck', PHP strings and callable function names can be reconstructed entirely from the permitted character set, enabling arbitrary code execution under web server permissions.

Recommended defensive actions

  1. Upgrade self-hosted vBulletin installations to version 6.2.2 or apply the available security patch for your installed branch (6.2.1, 6.2.0, or 6.1.6).
  2. Monitor web server access logs for POST requests to ajax/render/pagenav that carry unusually long or operator-dense pagenav[pagenumber] parameter values.
  3. Verify the patched version is running on every self-hosted vBulletin instance, particularly those managed by third parties, given the historical pattern of forums remaining on vulnerable builds after prior disclosures in this component.
  4. Restrict network access to the ajax/render/pagenav route at the web server or perimeter layer as a temporary mitigation where immediate patching is not possible.

Uncertainties and evidence gaps

  • No CVE.org or NVD record for CVE-2026-61511 was available at the time of disclosure, so no official CVSS severity score exists; NVD curtailed routine score enrichment for new CVEs earlier in 2026.
  • SSD credits an unnamed independent researcher while the exploit is signed by EgiX (Egidio Romano); the relationship between the two parties is not publicly established.
  • It is unknown whether CVE-2026-61511 was exploited during the approximately four-week window between the late-June patch release and the 27 July public disclosure; neither SSD nor vBulletin addressed this gap.
  • No lower version boundary is specified by SSD; older vBulletin 5.x or early 6.x branches may also contain the vulnerable code but are not covered by the advisory.
  • CVE-2026-50522, included in the CISA KEV on 22 July 2026, is a critical deserialization RCE in Microsoft SharePoint Server and is entirely unrelated to this vBulletin disclosure; it should not be associated with CVE-2026-61511.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated HTTP access to an internet-facing vBulletin forum; no credentials, session, administrative panel, or victim interaction required
ComponentTemplate engine math-processing method vB5_Template_Runtime::runMaths() in /includes/vb5/template/runtime.php
MechanismThe character-allowlist filter in runMaths() blocks alphabetic input but permits digits, parentheses, arithmetic and binary operators; this character set is sufficient to encode PHP function calls using restricted-character techniques, after which the filtered string is passed directly to eval()
ImpactArbitrary PHP and operating-system command execution under web server permissions, enabling data exfiltration, defacement, credential harvesting, and lateral movement
DetectionPOST requests to ajax/render/pagenav with anomalously long or operator-dense pagenav[pagenumber] values; no vendor-issued detection signature was available at time of disclosure
MitigationApply the vendor security patch for your installed branch (6.2.1, 6.2.0, or 6.1.6) or upgrade to vBulletin 6.2.2
Exploitation status

No confirmed in-the-wild exploitation of CVE-2026-61511 as of 27 July 2026; a public proof-of-concept is available from SSD Secure Disclosure but contains a trivially correctable one-character typographic error; a prior campaign exploiting CVE-2025-48827 and CVE-2025-48828 in the same vBulletin template engine saw confirmed active attacks within three days of EgiX's May 2025 disclosure.

Research process

The investigation began with the THN article and SSD advisory as primary sources and confirmed the core technical claims through two additional independently fetched sources. The historical exploitation pattern for the same component was verified via BleepingComputer to contextualise current risk. The CISA KEV entry in the source material was confirmed via search to reference a separate Microsoft SharePoint vulnerability unrelated to this story.

  1. What are the core technical facts and CVE details in the THN reporting?
    Fetched the THN article to extract CVE ID, affected versions, patch timeline, researcher credit, and exploitation status
    thehackernews.com ↗

    Confirmed CVE-2026-61511 in vBulletin 6.2.1/6.1.6 and earlier; patch in 6.2.2 (1 July 2026); PoC has a trivially correctable one-character typo; no confirmed exploitation; exploit signed by EgiX (Egidio Romano); SSD advisory URL identified as the primary source

    why Established the baseline factual claims requiring independent corroboration and provided the SSD advisory URL to fetch directly

  2. Does the SSD primary advisory corroborate and extend the technical claims?
    Fetched the SSD Secure Disclosure advisory page directly
    ssd-disclosure.com ↗

    Confirmed runMaths() in /includes/vb5/template/runtime.php, the regex filter permitting operator characters, the phpfuck encoding technique, unauthenticated vector via ajax/render/pagenav, and an interactive PoC demonstrating OS command execution

    why SSD is the coordinating disclosure body; their advisory is the authoritative primary source and independently confirms the mechanism without relying on THN's editorial summary

  3. Is there a third independent source confirming the affected versions and exploitation status?
    Searched for CVE-2026-61511 coverage and fetched the CybersecurityNews article
    cybersecuritynews.com ↗

    Independent confirmation of CVE-2026-61511, affected versions, phpfuck technique, pagenav vector, and no confirmed exploitation as of 27 July 2026; also noted potential downstream impact including lateral movement

    why A second independent domain corroborates both the scope and exploitation status, meeting the multi-source verification requirement

  4. Is the vendor's own patch announcement directly accessible to confirm the timeline?
    Searched for and attempted to fetch the official vBulletin forum security patch announcement
    forum.vbulletin.com ↗

    HTTP 403 response; page content not retrievable; the announcement's existence was confirmed by search results; the patch timeline is supported by the two independently fetched sources above

    why Could not directly verify vendor advisory text; the patch timeline is nonetheless consistently supported across all sources fetched; this gap is noted as an uncertainty

  5. Was the prior vBulletin campaign by EgiX actually exploited in the wild?
    Fetched BleepingComputer's coverage of CVE-2025-48827 and CVE-2025-48828 exploitation
    bleepingcomputer.com ↗

    Confirmed active exploitation of CVE-2025-48827 and CVE-2025-48828 on honeypot systems by 26 May 2025, three days after EgiX published his disclosure; CVSS 10.0 and 9.0 respectively

    why Establishes the evidenced pattern that vBulletin template-engine disclosures by EgiX result in rapid in-the-wild exploitation; elevates urgency for unpatched self-hosted forums despite the absence of confirmed CVE-2026-61511 exploitation at the time of this report

  6. What is CVE-2026-50522 listed in the CISA KEV, and is it related to this story?
    Searched for CVE-2026-50522 to determine its nature and relationship to the vBulletin disclosure

    CVE-2026-50522 is a CVSS 9.8 unsafe deserialization RCE in on-premises Microsoft SharePoint Server, added to CISA KEV on 22 July 2026 following active exploitation; it is a separate incident entirely unrelated to vBulletin

    why Confirmed the CISA KEV entry in the source material must not be conflated with CVE-2026-61511; SharePoint and vBulletin are distinct products with distinct vulnerabilities; the KEV entry does not affect the exploitation status assessment for this story

Named in this story
ActorsEgiX (Egidio Romano)unnamed independent researcher (SSD-credited)
Targetsself-hosted vBulletin forum installationsinternet-facing forum communities
Related CVEs CVE-2026-61511CVE-2025-48827CVE-2025-48828

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
CISA KEVkev ok1655 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
The Hacker Newsnews ok7 records Primary evidence1 matched items Published the source report used to frame and date the event.
BleepingComputernews ok8 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
FIRST EPSSepss ok Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok666 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shodanresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-50522 CISA KEV Microsoft SharePoint · added 2026-07-22 CISA catalog ↗
CVE-2026-50522 EPSS 57.1% 99th percentile exploitation probability
PoC & exploit code1
vBulletin Runtime Template runMaths Preauth RCE – SSD Secure Disclosure ssd-disclosure.com ↗

Primary disclosure containing the interactive PoC; exploit signed by EgiX (Egidio Romano)

Vendor & gov advisories2
vBulletin Runtime Template runMaths Preauth RCE – SSD Secure Disclosure ssd-disclosure.com ↗

Coordinating disclosure body; confirms affected versions, attack vector, patch timeline, and phpfuck encoding technique

Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw – The Hacker News thehackernews.com ↗

Secondary reporting that independently verified the PoC typo and overall disclosure timeline

Analysis & research2
Critical vBulletin Flaw Lets Unauthenticated Attackers Execute PHP Code Remotely – CybersecurityNews cybersecuritynews.com ↗

Independent corroboration of the phpfuck technique, pagenav attack vector, and no-exploitation status

Hackers are exploiting critical flaw in vBulletin forum software – BleepingComputer bleepingcomputer.com ↗

Documents confirmed in-the-wild exploitation of CVE-2025-48827 and CVE-2025-48828 in May 2025, establishing the prior exploitation pattern from the same researcher and component