Live › vulnerability › CVE-2026-61511
Go to dashboardvBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection flaw tracked as CVE-2026-61511, rated CVSS 9.8. Per Cloudflare's WAF changelog, successful exploitation may lead to remote code execution, with possible data exposure and service disruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 17:33 UTC, 1h before NVD. All times on this page are UTC.
Sites running vBulletin 5.x up to and including 5.7.5 or 6.x up to and including 6.2.1 are affected. Sites on other versions, or without vBulletin, can skip it; the sources do not describe the required configuration.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-08-11 · Changelog
New updates and improvements at Cloudflare.
August 11, 2026
This release introduces new protection for a remote code execution vulnerability in vBulletin and improves two existing detections.
Key Findings
Impact
Successful exploitation of CVE-2026-61511 may lead to remote code execution on affected vBulletin systems, potentially resulting in unauthorized access, data exposure, service disruption, and broader compromise of the hosting environment. Administrators are strongly encouraged to apply vendor updates and recommended mitigations.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...94f3006b | N/A | vBulletin - Remote Code Execution - CVE:CVE-2026-61511 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...098b749e | N/A | Version Control - Information Disclosure - Beta | Log | Block | This rule is merged into the original rule "Version Control - Information Disclosure" (ID: ...0550c529) |
| Cloudflare Managed Ruleset | ...d56225d8 | N/A | vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132 - Beta | Log | Block | This rule is merged into the original rule "vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132" (ID: ...8fe9f1c7) |
This page as .md · .json · in your agent: get_signal("CVE-2026-61511")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.