vBulletin Patches Pre-Auth RCE: Public Exploit Is Out

vBulletin has released a patch for a critical unauthenticated remote code execution vulnerability. A public proof-of-concept exploit is already circulating. If you run a vBulletin forum, patch now — not this sprint.

What changed

The flaw is in vBulletin’s template rendering engine. An unauthenticated attacker can pass malicious input through the PHP template processor and trigger arbitrary server-side code execution. No login required. No user interaction needed.

BleepingComputer reports that vBulletin has shipped a fix and a public proof-of-concept is already available. A CVE identifier had not been confirmed in public advisories at time of writing — check vBulletin’s official security announcements and NVD for the official assignment as details are confirmed.

Pre-auth RCE plus a live PoC is a very short fuse on active exploitation. Automated scanner pickup typically follows PoC publication within hours.

What to do

1. Update vBulletin to the patched release immediately. The specific build numbers are in vBulletin’s support portal and announcements forum.
2. If you cannot patch today: minimize internet exposure of the forum’s administrative interface. Template editing is an admin function — blocking that surface from the public internet reduces attack opportunity but does not close the underlying vulnerability in the main application.
3. Review your logs for anomalous requests hitting unauthenticated paths — login, registration, and password reset flows are the likely probe targets for this class of template injection.
4. Track the CVE assignment via vBulletin’s announcements or NVD search once published.

Priority call

vBulletin powers a large share of older internet forums — communities that frequently run long-standing installations with deferred update schedules. Wide install base plus slow patching culture plus public PoC is exactly what opportunistic attackers scan for.

This is a patch-before-end-of-day situation. The window between PoC publication and active scanning against this class of flaw is not days.

For broader context on the current wave of pre-auth RCE activity, see FastJSON zero-day RCE targeting US firms and TeamCity CVSS 9.8 RCE — all on-prem versions.