JA EN
shiichan

Cloudflare WAF Now Blocks a Critical vBulletin Remote Code Execution Flaw!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hi, it's me! I found a security update today that I think a lot of you will want to know about: Cloudflare's Web Application Firewall (WAF) just picked up a new protection rule.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, as of August 11, 2026, Cloudflare updated its WAF managed ruleset with a new detection rule that blocks remote code execution (RCE) attempts against a critical vBulletin vulnerability, CVE-2026-61511. The key change: this detection used to only log matches, and now it actively blocks them.

Why it matters

CVE-2026-61511 lets an attacker execute arbitrary code remotely on vulnerable vBulletin installations. Successful exploitation can lead to unauthorized access, data exposure, service disruption, and broader compromise of the hosting environment — so if you're running a vBulletin-based forum, this is worth paying attention to.

What changes

If your site has Cloudflare's WAF managed ruleset enabled, this new rule is applied automatically, blocking attacks that target CVE-2026-61511 — no extra configuration needed on your end. That said, Cloudflare still recommends applying the vendor's own updates and mitigations, so don't rely on the WAF alone; patch vBulletin itself too.

Dive Deep

Alongside the new rule, two existing detections were strengthened and merged into their canonical rules, both upgraded from Log to Block:

  • The "Version Control - Information Disclosure" (Beta) rule
  • The vBulletin code-injection rule for CVE-2019-17132 (Beta), covering invalid image format exploits

Both are now merged into their respective original rules with blocking enabled.

Wrap-up

  • A new detection rule blocks the vBulletin RCE flaw CVE-2026-61511, action set to Block
  • Two existing Beta rules were strengthened and merged, also now set to Block
  • If you run vBulletin, don't forget to apply the vendor's own patches too

This one's for anyone running Cloudflare's WAF, especially if you're hosting a vBulletin forum!

Related posts