A severe remote code execution vulnerability has been reported in vBulletin, a popular forum software platform widely utilized across numerous websites and forums. Identified as CVE-2026-61511, this flaw was independently discovered by an expert security researcher working with SSD Secure Disclosure and publicly disclosed on July 27, 2026. The vulnerability affects versions of vBulletin 6.2.1 and earlier, as well as 6.1.6 and older, potentially compromising a substantial number of active forums.
However, it allows the XOR operator (^), which opens up "PHP" style exploitation techniques that use bitwise operations on strings constructed from allowed characters through obfuscation methods similar to JSFuck in JavaScript.
It directly assigns the user-provided pagenav[pagenumber] parameter to a template variable that is then processed by {vb:math} and ultimately evaluated through an unauthenticated eval() call without any authentication checks. The script encodes arbitrary PHP function calls, such as system(), using only numeric and XOR operations to bypass the regex filter. Monitor logs for unusual POST requests containing pagenav[pagenumber] values with heavy parentheses or XOR patterns for early containment of threats, reducing response costs and business disruptions with ANY.RUN.
