Revive Adserver CVE-2026-50741

Exploitation requires an authenticated low-privilege account (CVSS PR:L) and network reachability to the Revive Adserver application; no user interaction is needed. The concrete trigger is one of two named paths: supplying a disallowed-yet-structurally-valid plugin identifier in the type parameter, or calling the ox.setChannelTargeting XML-RPC API method - so an instance with the XML-RPC interface disabled removes that second vector. The principal limiting factor is the credential requirement: the attacker must first hold a valid (even minimally privileged) account, so instances that restrict account creation and are not internet-exposed face materially lower risk.

The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity attack that requires only low-privilege authentication and no user interaction, with full triple-impact - a genuinely high-priority profile for any internet-exposed instance. No EPSS score, KEV entry, or confirmed public POC was provided, so there is no signal of active or widespread exploitation; the realistic risk is therefore driven by the low bar to exploit once an attacker holds any authenticated account. A notable nuance: this is explicitly a bypass of a previously shipped fix, and multiple independent researchers reported equivalent vectors, which raises the likelihood that further variants or working exploit code surface quickly even though none is confirmed now. Treat the PR:L requirement as the main limiting factor - exposure depends on how easily an attacker can obtain a low-privilege Revive account.

An attacker who has obtained any low-privilege Revive Adserver account sends a crafted request specifying a disallowed-but-valid plugin identifier as the type value, or invokes the ox.setChannelTargeting XML-RPC method, slipping past the incomplete CVE-2026-34916 filter to load attacker-influenced code. The server executes the injected code, giving the attacker full control of the host. No public exploit is confirmed, but the low attack complexity and multiple reported variants make a working exploit plausible.