Revive Adserver CVE-2026-34917

The attacker must hold a valid, active low-privileged account on the Revive Adserver web admin console - unauthenticated exploitation is not possible (CVSS PR:L). The XML-RPC API endpoint must be network-reachable from the attacker's position; if the API is firewalled to only trusted hosts, exploitation is blocked at the network layer. No special non-default configuration is cited as a prerequisite beyond having both the web console and XML-RPC API operational, which is a standard Revive Adserver deployment. Exploitation is limited to users who already hold some level of console access; external unauthenticated attackers cannot exploit this directly.

The NVD CVSS 3.0 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a moderate, network-exploitable flaw requiring only low-level authentication with no user interaction. However, the practical risk is likely understated by C:L/I:N because unauthorized XML-RPC API access in an ad server typically permits both read and write operations, implying at minimum limited integrity impact not captured in the original vector. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. No POC has been identified. The real-world risk is best characterized as a privilege escalation pathway: the flaw alone yields limited direct impact, but it serves as a reliable stepping stone to exploit secondary API-level weaknesses under an admin API context. The CPE wildcard (all versions) suggests broad version exposure, though Revive Adserver has a niche deployment footprint, limiting the aggregate attack surface.

An attacker authenticates to the Revive Adserver web admin console with a low-privileged account and extracts their active session ID from the browser. They then craft an XML-RPC API request, substituting the web console session ID in place of valid admin credentials. The API accepts the token, granting admin-level API access, which the attacker uses to invoke privileged API methods - such as modifying ad campaigns, extracting configuration data, or triggering further API-level vulnerabilities.