Critical Pre‑Auth RCE (CVE‑2026‑61511) in vBulletin Allows Unauthenticated Code Execution

vBulletin Critical Pre‑Auth RCE (CVE‑2026‑61511) Exposes Unpatched Forum Servers

What Happened — A pre‑authentication remote code execution flaw (CVE‑2026‑61511) was disclosed in vBulletin 5.x and 6.x. The vulnerability resides in the runMaths() function, which fails to sanitize input before passing it to PHP’s eval(). A public proof‑of‑concept allows attackers to send a crafted request to ajax/render/[template] and execute arbitrary PHP code on the server.

Why It Matters for Compliance & Audit Readiness

• The flaw bypasses the “no‑unauthenticated access” control that SOC 2’s CC6.1 – System Operations expects, highlighting gaps in patch‑management and secure‑development processes.
• Continuous evidence of remediation (patch deployment, WAF rule changes) is essential to demonstrate due diligence during a SOC 2 audit.

Who Is Affected — Online communities, gaming portals, support sites, and any organization that runs a public‑facing vBulletin forum (spanning tech, retail, media, and government sectors).

Recommended Actions

• Upgrade to vBulletin 6.2.2 (or later) immediately; back‑port patches to older 6.x releases where possible.
• Apply a web‑application firewall rule to block the vulnerable ajax/render/* endpoint until patched.
• Document the patch‑management activity in your SOC 2 change‑management logs and capture evidence for audit reviewers.

Technical Notes

• Attack vector: unauthenticated HTTP request to ajax/render/[template].
• CVSS (pre‑release): 9.8 (Critical).
• Exploited component: PHP eval() via insufficient input sanitization in runMaths().
• Public PoC: available, raising the likelihood of automated scanning.

Source: BleepingComputer