actively-exploited-vulnerabilityinternet-facing-service-vulnerabilitywidely-deployed-product-advisoryinitial-access-method

Actively Exploited vBulletin RCE Flaws Expose Unpatched Forums

Active Exploitation · 2 sources · Updated 4mo ago · First seen Jun 12, 2025

Researchers detailed how attackers can abuse improperly exposed "protected" method handling in vBulletin to achieve unauthenticated remote code execution on internet-facing forums. The issue affects vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 running on PHP 8.1 or newer, and is tracked as CVE-2025-48827 and CVE-2025-48828. Technical analysis showed the flaws can be chained from remote access to protected method invocation and full code execution on vulnerable servers.

CSIRT.SK reported the vulnerabilities are being actively exploited in the wild, with abuse observed since at least May 2025, while many exposed instances remain unpatched. The vendor had reportedly released fixes in April 2024 without detailed public disclosure, leaving administrators unaware of the severity until later reporting. Defenders are being urged to update affected installations to the recommended patched versions or the latest release and to review server and application logs for evidence of compromise.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · May 23, 2025 – Jun 12, 2025

Jun 12, 20251y ago
CSIRT.SK warns of actively exploited vBulletin vulnerabilities
CSIRT.SK published an alert describing CVE-2025-48827 and CVE-2025-48828 as critical, actively exploited vulnerabilities in vBulletin. The advisory urged administrators to update to fixed versions and review logs for signs of compromise.
Aktívne zneužívané kritické zraniteľnosti v platforme vBulletin | CSIRT.SK
Jun 12, 20251y ago
Exploitation of vBulletin flaws observed since at least May 2025
CSIRT.SK reported that the critical vBulletin vulnerabilities CVE-2025-48827 and CVE-2025-48828 have been actively exploited since at least May 2025. The bugs allow unauthenticated remote exploitation on vulnerable installations running PHP 8.1 or newer, including remote code execution.
Aktívne zneužívané kritické zraniteľnosti v platforme vBulletin | CSIRT.SK
Jun 12, 20251y ago
vBulletin issues silent fixes for two critical vulnerabilities
The vendor reportedly released updates in April 2024 that addressed what were later identified as CVE-2025-48827 and CVE-2025-48828, but did so without detailed public disclosure. The flaws affected vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3.
Aktívne zneužívané kritické zraniteľnosti v platforme vBulletin | CSIRT.SK
May 23, 20251y ago
Technical analysis published on vBulletin N-day RCE
A technical write-up dissecting an N-day remote code execution issue in vBulletin was published, focusing on abuse of a supposedly protected method. The analysis documented the vulnerability mechanics and exploitation path.
Don't Call That "Protected" Method: Dissecting an N-Day vBulletin RCE

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

PHP code execution through vBulletin Template Conditionals (CVE-2025-48828)Unauthenticated Protected API Method Invocation in vBulletin on PHP 8.1+ (CVE-2025-48827)

Affected products

1 linked

Vbulletin

Organizations

1 linked

Vbulletin

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Csirt SkNews · Jun 12, 2025

Aktívne zneužívané kritické zraniteľnosti v platforme vBulletin | CSIRT.SKOpen source ↗

Symantec BlogNews · May 23, 2025

Don't Call That "Protected" Method: Dissecting an N-Day vBulletin RCEOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News