Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

Public exploit code for an unauthenticated vBulletin template-engine remote code execution (CVE-2026-61511) was published July 27; the vendor had already released fixes (including v6.2.2 on July 1). The PoC uses a restricted-character technique to reconstruct PHP calls, and while the exploit is functional after a trivial typo fix, SSD and others reported no confirmed active exploitation—risk remains chiefly for internet-facing, self-hosted forums that have not applied the patch. Defenders should monitor POSTs to routestring=ajax/render/pagenav with unusually long or operator-heavy pagenav[pagenumber] parameters.