Public Exploit Emerges for Critical vBulletin Pre-Auth RCE

vBulletin disclosed and patched CVE-2026-61511, a critical unauthenticated remote code execution flaw in its template engine that can let attackers execute arbitrary PHP code on self-hosted forum servers. The bug affects multiple releases, including 5.x through 5.7.5 and 6.x through 6.2.1 according to advisory coverage, and is fixed in 6.2.2 with patches also issued for supported branches. The vulnerability is rooted in vB5_Template_Runtime::runMaths() in vb5/template/runtime.php, where insufficient input filtering allows attacker-controlled expressions to reach PHP's eval().