External risk intelligence

vBulletin Eval Injection RCE via Template Runtime

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-61511

vBulletin is a widely deployed forum software designed to be public-facing by default. This vulnerability allows for unauthenticated code execution via standard web requests to the application's template rendering route, which is exposed directly to the internet in normal operation.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in widely deployed forum software, allowing unauthenticated attackers to execute arbitrary code remotely through crafted web requests. This impacts the software's template rendering mechanism, potentially enabling broad compromise.

Unauthenticated attackers can run custom code remotely.
It affects public-facing forum software widely used online.
Confirm if our systems use this software and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can execute arbitrary PHP code by sending specially crafted input through the `pagenav[pagenumber]` parameter. This bypasses filters by using a phpfuck-style encoding, leading to code execution via an unauthenticated AJAX route.

No authentication or special access required.
Injected code via `pagenav[pagenumber]` parameter.
Arbitrary PHP code execution and server compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to execute arbitrary PHP code on the server by sending specially crafted input through a public interface. This could impact the integrity and availability of the forum software and any systems it interacts with, when supported by the advisory.

Forum software and server code.
Via crafted input to a public route.
Arbitrary code execution on server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The platform or application owners are responsible for addressing this critical vulnerability in vBulletin's template runtime. The immediate first step is to identify all instances of the affected software, determine their exposure and business criticality, and then ascertain the accountable owner before planning remediation.

Application owners should own the remediation effort.
Verify instances and assess business criticality.
Plan and coordinate immediate mitigation or patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is vBulletin?

vBulletin is a popular content management system and community forum platform used to host online discussion boards. It serves as the backbone for websites where users interact, share content, and maintain threads. Because it handles significant user-generated content and serves as a public hub, it is typically deployed as a web application accessible over the internet to allow for widespread participation.

How does CVE-2026-61511 work?

This vulnerability is an eval injection, classified as CWE-95. It occurs because the template runtime does not properly sanitize input before processing mathematical functions. By sending a specially crafted request to the pagenav[pagenumber] parameter, an attacker can bypass the system's regex filters using specific character encodings. This flaw allows the application to mistakenly interpret and execute arbitrary PHP code provided by the attacker.

Do I need to be logged in to trigger this bug?

No. This vulnerability is reachable by unauthenticated remote attackers. The malicious request is processed through a public AJAX template route, meaning no user account or special permissions are required to initiate the attack. If the application receives a malformed request targeting the vulnerable pagenav parameter, the template runtime executes the injected code automatically without further interaction.

Is my instance at risk according to Halo Surface Signal?

Yes, Halo Surface Signal flags this as 'Very likely' because vBulletin is intentionally public-facing software. Since the vulnerability resides in the application's standard template rendering route—a feature that must be internet-accessible for a forum to function—the attack path is exposed by default. If your vBulletin installation is connected to the internet, it is considered reachable by potential attackers.

What are the first steps to address this CVE?

Start by identifying all instances of vBulletin within your environment to determine where the software is running. Once mapped, confirm the version numbers to see if they fall within the affected ranges. Engage the business owners responsible for these applications immediately to coordinate patching efforts, as remediation typically requires applying official updates or vendor-provided fixes to the affected template runtime code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.