Public Exploit Now Live for vBulletin Pre-Auth Remote Code Execution

What Happened

A working public exploit dropped on July 27 for a critical remote code execution vulnerability in vBulletin, according to The Hacker News. The flaw allows an unauthenticated attacker to send a crafted HTTP request that reaches PHP's eval() function, executing arbitrary code on the forum server. No account is required. No admin access is required. No victim interaction is required.

The vulnerability was discovered by SSD Secure Disclosure during a follow-up audit of a February fix (CVE-2026-27577 in the n8n ecosystem — but the vBulletin flaw is a separate, distinct issue). The patch exists, but the public release of working exploit code means the window between "unpatched" and "compromised" has collapsed to near zero.

Why It Matters

Pre-authentication RCE is as bad as it gets. Any vBulletin installation reachable from the internet — and most are, by design — is now a live target. The moment exploit code is public, automated scanners and opportunistic threat actors begin mass-scanning for vulnerable endpoints within hours. Forum software historically makes a high-value target: user databases contain email addresses, password hashes, private messages, and often payment history from subscriptions.

If your organization runs a vBulletin-powered community, support forum, or internal knowledge base, assume you are being probed right now. The same applies if you manage hosting for clients running vBulletin.

What to Do

Patch immediately. vBulletin has released a fix — apply it before anything else today.

1. Identify your version: Log into your AdminCP and check the version string in the footer or under Settings → Options.
2. Apply the vendor patch: Download the latest release from vBulletin's customer portal. Follow the standard upgrade procedure (back up files and database first).
3. Check your logs now: Look for unusual POST requests to ajax.php, index.php, or any endpoint that processes template or expression input. Unexpected eval() traces in your PHP error log are a red flag.
4. Restrict access if you can't patch immediately: Place your AdminCP behind IP allowlisting or HTTP basic auth at the web server level as a temporary mitigation. This does not fully close the pre-auth vector but reduces the attack surface.
5. Scan for indicators of compromise: Look for new PHP files with randomized names, unexpected cron jobs, or outbound connections from your web process.

If you run vBulletin under shared hosting, contact your host directly and escalate as urgent — they may need to apply server-level controls while you coordinate the application patch.

Do not wait on this. Public exploits for unauthenticated RCE bugs get weaponized in ransomware and data-exfiltration campaigns within 24–48 hours of release.