CVE-2020-17496: vBulletin ajax render endpoint allows unauthenticated remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network remote code execution with public exploit code, KEV listing and very high EPSS probability.

What it is

vBulletin 5.5.4 through 5.6.2 permits remote command execution through crafted subWidgets data sent to an ajax/render/widget_tabbedcontainer_tab_panel request. The flaw is an incomplete fix for CVE-2019-16759, so the earlier patch did not fully close the injection path. It matters because a public exploit exists and the issue is in CISA's Known Exploited Vulnerabilities catalog.

Impact

An unauthenticated attacker can execute arbitrary commands on the web server, leading to full compromise of the vBulletin host and any data or credentials it holds.

Attack surface

Reachable over the network via a crafted HTTP request to the ajax/render/widget_tabbedcontainer_tab_panel endpoint; the CVSS vector shows no privileges or user interaction required.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to apply vendor updates, and EPSS gives a 30-day probability of 0.8774 (99.75th percentile). Multiple references are tagged Exploit, indicating public exploit code is available.

What to do

• Apply the vendor security patch for vBulletin 5.6.0/5.6.1/5.6.2 or upgrade to a fixed release immediately.
• If patching cannot be done at once, restrict or block external access to the ajax/render/widget_tabbedcontainer_tab_panel endpoint.
• Place the forum behind a WAF or reverse proxy with rules blocking crafted subWidgets parameters.
• Audit the host for signs of compromise and rotate credentials and secrets stored on the server.
• Confirm the CVE-2019-16759 fix is fully applied, since this issue is an incomplete fix of that one.

Detection

• Search web logs for POST requests to ajax/render/widget_tabbedcontainer_tab_panel containing subWidgets parameters.
• Monitor for unexpected outbound connections or child processes spawned by the web server user.
• Alert on file writes or new files in web-accessible directories on the vBulletin host.
• Review for webshell artifacts and unusual PHP files in the forum installation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.