---
id: "CVE-2020-17496"
kind: "vulnerability"
aliases: ["CVE-2020-17496"]
title: "vBulletin vBulletin: vBulletin PHP Module Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.87478
exploited: true
status: "open"
category: "vendor"
products: [{"name": "vBulletin vBulletin", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "vBulletin", "fixed": ["5.6.0 security patch", "5.6.1 security patch", "5.6.2 security patch"], "affected": ">= 5.5.4, <= 5.6.2 (without Aug 2020 security patch)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "php", "poc-public", "self-hosted", "vbulletin", "vendor"]
not_affected_if: ["managed-hosting", "vbulletin-cloud"]
published_at: "2020-08-12T14:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:55:38+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-17496", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-17496", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-17496", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:55:38+00:00"}]
---

# vBulletin vBulletin: vBulletin PHP Module Remote Code Execution Vulnerability

Unauthenticated RCE in vBulletin 5.5.4 through 5.6.2: one POST to /ajax/render/widget_tabbedcontainer_tab_panel with subWidgets[0][template]=widget_php runs attacker PHP. It bypasses the earlier CVE-2019-16759 fix. A public PoC exists and exploitation is active (CISA KEV, Unit 42). vBulletin Cloud is not affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vBulletin vBulletin affected ? fixed ?
- vendor:vBulletin affected >= 5.5.4, <= 5.6.2 (without Aug 2020 security patch) fixed 5.6.0 security patch, 5.6.1 security patch, 5.6.2 security patch

## How to check

Check your vBulletin version in the AdminCP or footer: 5.5.4 to 5.6.2 without the August 2020 security patch is vulnerable, and older 5.x should be treated as vulnerable too. Check whether the patch files are applied by asking vBulletin support or comparing against the patch zip from the Member's Area. Search web logs for POSTs to ajax/render/widget_tabbedcontainer_tab_panel containing widget_php or subWidgets. Treat any hit as a possible compromise and look for webshells.

## Fix

Download and install the vendor security patch for your 5.6.x version (5.6.0, 5.6.1 or 5.6.2) from the Member's Area. Upload the zip's files over the existing ones. Older versions must be upgraded to 5.6.2 plus the patch. The vendor gives no separate patched version number. 5.6.3 Beta is unpatched and not for production.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-17496
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-17496
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-17496
- 2026-10-23T20:55:38+00:00 analyst — Vendor advisory (Aug 10 2020) ships security patches for 5.6.0/5.6.1/5.6.2 only; no new version number. NVD range 5.5.4-5.6.2; public PoC (Zenofex, Full Disclosure); exploited in wild per Unit 42 and CISA KEV.

## Documents

- [advisory] vBulletin 5.6.0, 5.6.1, 5.6.2 Security Patch https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch
- [describes] NVD CVE-2020-17496 https://nvd.nist.gov/vuln/detail/CVE-2020-17496
- [discussion] Unit 42: Exploits in the Wild for vBulletin CVE-2020-17496 https://unit42.paloaltonetworks.com/cve-2020-17496/
- [fix] vBulletin 5.6.0, 5.6.1, 5.6.2 Security Patch https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch
- [poc] Full Disclosure: RCE 0day in vBulletin 5.x (Zenofex) https://seclists.org/fulldisclosure/2020/Aug/5

## From the sources

The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_