{"id":"CVE-2026-61511","kind":"vulnerability","aliases":["CVE-2026-61511"],"related":[],"title":"vBulletin: eval injection lets unauthenticated requests run server code","description":"WAF Release - 2026-08-11 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 11, 2026\n\n## WAF Release - 2026-08-11\n\nThis release introduces new protection for a remote code execution vulnerability in vBulletin and improves two existing detections.\n\nKey Findings\n\n- A new detection provides protection against vBulletin CVE-2026-61511.\n- Two existing detections have been improved to strengthen coverage.\n\nImpact\n\nSuccessful exploitation of CVE-2026-61511 may lead to remote code execution on affected vBulletin systems, potentially resulting in unauthorized access, data exposure, service disruption, and broader compromise of the hosting environment. Administrators are strongly encouraged to apply vendor updates and recommended mitigations.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...94f3006b | N/A | vBulletin - Remote Code Execution - CVE:CVE-2026-61511 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...098b749e | N/A | Version Control - Information Disclosure - Beta | Log | Block | This rule is merged into the original rule \"Version Control - Information Disclosure\" (ID: ...0550c529) |\n| Cloudflare Managed Ruleset | ...d56225d8 | N/A | vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132 - Beta | Log | Block | This rule is merged into the original rule \"vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132\" (ID: ...8fe9f1c7) |","summary":"vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection flaw tracked as CVE-2026-61511, rated CVSS 9.8. Per Cloudflare's WAF changelog, successful exploitation may lead to remote code execution, with possible data exposure and service disruption.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudflare","forums","lab-disclosure","php","self-hosted","vbulletin","vendor"],"not_affected_if":["non-vbulletin-versions"],"how_to_check":"- Check the installed vBulletin version against the affected ranges (5.x through 5.7.5, 6.x through 6.2.1) in the admin control panel or the installed files; the sources do not name a file or command.\n- Confirm whether Cloudflare's Managed Ruleset rule \"vBulletin - Remote Code Execution - CVE:CVE-2026-61511\" is in Block mode if traffic passes through Cloudflare.","fix":"- Update vBulletin to a version outside the affected ranges; the first fixed version is unknown from these sources.\n- Apply the vendor's recommended mitigations; the sources do not specify them.\n- Until patched, keep the Cloudflare WAF rule \"vBulletin - Remote Code Execution - CVE:CVE-2026-61511\" in Block mode.","status":"open","published_at":"2026-07-27T14:16:59+00:00","first_seen_at":"2026-10-24T17:33:06+00:00","triaged_at":"2026-10-25T05:27:57+00:00","updated_at":"2026-10-25T05:27:57+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T05:27:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update vBulletin to a version outside the affected ranges; the first fixed version is unknown from these sources.\n- Apply the vendor's recommended mitigations; the sources do not specify them.\n- Until patched, keep the Cloudflare WAF rule \"vBulletin - Remote Code Execution - CVE:CVE-2026-61511\" in Block mode.","reach":"internet","title":"vBulletin: eval injection lets unauthenticated requests run server code","impact":"high","summary":"vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection flaw tracked as CVE-2026-61511, rated CVSS 9.8. Per Cloudflare's WAF changelog, successful exploitation may lead to remote code execution, with possible data exposure and service disruption.","category":"vendor","nicknames":[],"who_cares":["vbulletin","self-hosted","php","forums"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the vBulletin server remotely.","analyst_note":"Find the vendor advisory and first fixed version for CVE-2026-61511, and confirm the exploit preconditions; check https://nvd.nist.gov/vuln/detail/CVE-2026-61511.","how_to_check":"- Check the installed vBulletin version against the affected ranges (5.x through 5.7.5, 6.x through 6.2.1) in the admin control panel or the installed files; the sources do not name a file or command.\n- Confirm whether Cloudflare's Managed Ruleset rule \"vBulletin - Remote Code Execution - CVE:CVE-2026-61511\" is in Block mode if traffic passes through Cloudflare.","needs_analyst":true,"not_affected_if":["non-vbulletin-versions"],"who_is_affected":"Sites running vBulletin 5.x up to and including 5.7.5 or 6.x up to and including 6.2.1 are affected. Sites on other versions, or without vBulletin, can skip it; the sources do not describe the required configuration.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000772,"input_tokens":3925,"output_tokens":758,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-08':73C,89C '-11':74C,90C '-17132':246C,267C '-2019':245C,266C '-2026':11A,14A,45B,119C,135C,197C '-61511':12A,15A,46B,120C,136C,198C '0550c529':231C '098b749e':209C '11':84C '2026':72C,85C,88C '5':28B '5.7.5':31B '6':33B '6.2.1':36B '8fe9f1c7':269C '9.8':49B '94f3006b':189C 'access':151C 'action':182C,184C 'administr':163C 'affect':144C 'appli':168C 'august':83C 'beta':215C,247C 'block':200C,217C,249C 'broader':157C 'changelog':54B,75C,76C 'cloudflar':16B,51B,82C,186C,206C,232C 'code':9A,61B,99C,141C,193C,238C,259C 'comment':185C 'compromis':158C 'contain':37B 'control':212C,227C 'coverag':129C 'cve':10A,13A,44B,118C,134C,195C,196C,243C,244C,264C,265C 'cvss':48B 'd56225d8':235C 'data':65B,152C 'descript':180C 'detect':108C,113C,123C,205C 'disclosur':20B,214C,229C 'disrupt':69B,155C 'encourag':166C 'environ':162C 'eval':2A,39B 'execut':62B,100C,142C,194C 'exist':107C,122C 'exploit':56B,132C 'exposur':66B,153C 'find':110C 'flaw':41B 'format':242C,263C 'forum':17B 'host':24B,161C 'id':176C,179C,230C,268C 'imag':241C,262C 'impact':130C 'improv':80C,105C,126C 'inform':213C,228C 'inject':3A,40B,239C,260C 'introduc':93C 'invalid':240C,261C 'key':109C 'lab':19B 'lab-disclosur':18B 'lead':58B,138C 'legaci':177C 'let':4A 'log':199C,216C,248C 'manag':187C,207C,233C 'may':57B,137C 'merg':221C,253C 'mitig':173C 'n/a':190C,210C,236C 'new':77C,94C,112C,183C,204C 'origin':224C,256C 'per':50B 'php':21B 'possibl':64B 'potenti':147C 'previous':181C 'protect':95C,115C 'provid':114C 'rate':47B 'recommend':172C 'releas':71C,87C,92C 'remot':60B,98C,140C,192C 'request':6A 'result':148C 'rule':175C,178C,219C,225C,251C,257C 'ruleset':174C,188C,208C,234C 'run':7A 'self':23B 'self-host':22B 'server':8A 'servic':68B,154C 'strengthen':128C 'strong':165C 'success':55B,131C 'system':146C 'track':42B 'two':106C,121C 'unauthent':5A 'unauthor':150C 'updat':78C,170C 'vbulletin':1A,25B,27B,103C,117C,145C,191C,237C,258C 'vendor':26B,169C 'version':211C,226C 'vulner':101C 'waf':53B,70C,86C 'x':29B,34B","nicknames":[],"mitigations":[],"who_affected":"Sites running vBulletin 5.x up to and including 5.7.5 or 6.x up to and including 6.2.1 are affected. Sites on other versions, or without vBulletin, can skip it; the sources do not describe the required configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-27T14:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/#CVE-2026-61511","url":"https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/","severity":null,"published_at":"2026-08-11T17:32:58+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:33:06+00:00","fetched_at":"2026-10-24T17:33:06+00:00","note":"Cloudflare: WAF Release - 2026-08-11 · Changelog"},{"source":"nvd","external_id":"CVE-2026-61511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61511","severity":null,"published_at":"2026-07-27T14:16:59+00:00","modified_at":"2026-10-14T04:18:24+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null}],"documents":[{"id":2856,"url":"https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/","title":"Cloudflare: WAF Release - 2026-08-11 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-08-11 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 11, 2026\n\n## WAF Release - 2026-08-11\n\nThis release introduces new protection for a remote code execution vulnerability in vBulletin and improves two existing detections.\n\nKey Findings\n\n- A new detection provides protection against vBulletin CVE-2026-61511.\n- Two existing detections have been improved to strengthen coverage.\n\nImpact\n\nSuccessful exploitation of CVE-2026-61511 may lead to remote code execution on affected vBulletin systems, potentially resulting in unauthorized access, data exposure, service disruption, and broader compromise of the hosting environment. Administrators are strongly encouraged to apply vendor updates and recommended mitigations.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...94f3006b | N/A | vBulletin - Remote Code Execution - CVE:CVE-2026-61511 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...098b749e | N/A | Version Control - Information Disclosure - Beta | Log | Block | This rule is merged into the original rule \"Version Control - Information Disclosure\" (ID: ...0550c529) |\n| Cloudflare Managed Ruleset | ...d56225d8 | N/A | vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132 - Beta | Log | Block | This rule is merged into the original rule \"vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132\" (ID: ...8fe9f1c7) |","published_at":"2026-08-11T17:32:58+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}