CVE-2026-61511 is an eval injection vulnerability in vBulletin's template runtime, specifically in the vB5_Template_Runtime::runMaths() method. It affects vBulletin 5.x through 5.7.5 and 6.x through 6.2.1. The vulnerability allows remote attackers to execute arbitrary PHP code by supplying malicious input to the pagenav[pagenumber] parameter. The root cause is an insufficiently restrictive regular expression filter that can be bypassed using phpfuck-style encoding, enabling code injection and execution without authentication via the ajax/render template route.

Successful exploitation results in unauthenticated remote code execution with full control over the affected system. This can lead to complete compromise of the server hosting the vulnerable vBulletin installation, including data theft, service disruption, and further network pivoting. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the ajax/render template route if possible and monitor for suspicious activity related to the pagenav[pagenumber] parameter. Avoid exposing vulnerable versions publicly and consider temporary mitigations such as web application firewall rules to block suspicious payloads targeting this parameter.