What is the CVSS score of CVE-2026-34916?

CVE-2026-34916 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Revive Adserver are affected by CVE-2026-34916?

Revive Adserver 6.0.6 and earlier contains a critical authenticated code injection vulnerability exploitable by low-privileged users, enabling arbitrary code execution during banner delivery that…

How to fix or mitigate CVE-2026-34916?

24 hours: Inventory all Revive Adserver instances running version 6.0.6 or earlier; immediately restrict delivery-limitations configuration access to administrative staff and disable the feature for standard users. 7 days: Contact Revive Software regarding patch release timeline; if no patch expected within 60 days, initiate procurement and evaluation of alternative ad servers (OpenX, Google Ad Manager). 30 days: Apply vendor patch immediately upon release (version TBD pending advisory) or complete migration to alternative platform; audit banner delivery logs for historical exploitation attempts.

Revive Adserver CVE-2026-34916

EUVD-2026-38507 HIGH

Code Injection (CWE-94)

2026-06-23 hackerone

GHSA-qxq8-64vv-45v8

PHP RCE Code Injection Revive Adserver

8.8

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable admin UI (AV:N), straightforward injection (AC:L), requires authenticated low-priv account (PR:L), no user interaction, stored RCE yields full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 17:03 vuln.today

DescriptionCVE.org

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated.

Articles & Coverage 2

News 4 New PHP Vulnerabilities - 4 High Severity, No Public POC Jun 24, 2026 News 3 New PHP Vulnerabilities - 3 High Severity Jun 23, 2026

AnalysisAI

Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to embed arbitrary PHP into the compiledlimitations database field via the logical parameter of delivery limitations, with execution occurring later during banner delivery. The flaw is exploitable over the network with low complexity and yields full confidentiality, integrity, and availability impact (CVSS 8.8), though no public exploit identified at time of analysis.

Technical ContextAI

Revive Adserver is an open-source PHP ad-serving platform (forked from OpenX) used to manage and deliver banner campaigns. Delivery limitations are rules (geo, time, frequency, etc.) attached to banners; they are compiled into PHP expressions and persisted in the compiledlimitations column, then eval'd or otherwise executed by the delivery engine for each ad impression. CWE-94 (Improper Control of Generation of Code) applies because the 'logical' parameter - intended to be a simple boolean/operator token (e.g. and/or) - was concatenated into the compiled PHP without validation, allowing attacker-controlled PHP to be stored and later executed. CPE cpe:2.3:a:revive_adserver:revive_adserver:*:*:*:*:*:*:*:* covers all versions up to and including 6.0.6.

RemediationAI

Upgrade to the version released after 6.0.6 that contains the improved input sanitisation for the logical parameter; the input data references the HackerOne disclosure at https://hackerone.com/reports/3656781 but does not name an exact fixed release, so verify the fixed version against the official Revive security advisory page before deploying. As compensating controls until patched, restrict who holds advertiser/trafficker privileges and audit recent edits to delivery limitations for suspicious values in the logical field or compiledlimitations column, and consider blocking external access to the admin UI (typically /www/admin/) via IP allow-list or WAF rules that reject non-boolean tokens in the logical parameter - note this will break legitimate UI edits if rules are too aggressive. Disabling self-registration of advertiser accounts is also strongly recommended for any internet-facing instance.