CVE-2019-16759: vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax...

Security readout for executives and security teams

This is a critical vBulletin forum flaw that can let an unauthenticated remote attacker run commands on the server. Public sources describe exploit publication and mass attacks, and CISA lists it in KEV. Any Internet-facing vBulletin 5.x site at or below 5.5.4 should be treated as urgent and potentially compromised until checked. Highest exposure is public-facing vBulletin 5.x through 5.5.4, especially forums reachable from the Internet. The provided affected data does not identify CPEs, so exposure validation should rely on asset inventory, application fingerprinting, and confirmed vBulletin version rather than product metadata alone. Treat this as an emergency for any exposed vBulletin 5.x deployment through 5.5.4. The business risk is full server compromise, data theft, site defacement, and follow-on intrusion. Prioritize inventory, remediation, and compromise assessment immediately. Mitigation focus: Identify all vBulletin instances and confirm exact versions.; Follow vBulletin vendor guidance for supported fixes or upgrades.; Remove, isolate, or restrict public access to vulnerable instances until remediated..

Prepared

May 22, 2026, 05:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.