Revive Adserver CVE-2026-50742

Exploitation requires the attacker to hold a low-privilege authenticated account on the Revive Adserver instance with sufficient permissions to create or modify entity names (ACL zones or banners) that are later evaluated by the maintenance scripts. The XSS payload only fires when an administrator actively runs the maintenance-acl-check.php or maintenance-banners-check.php tools AND when an inconsistency is detected in the affected entity - the CVE description explicitly states that payload execution is not entirely under the attacker's control. This makes exploitation conditional on: (1) attacker having low-privilege write access to entity names, (2) an administrator using the specific maintenance tools after the payload is stored, and (3) the maintenance logic detecting an inconsistency in the tainted entity. Unauthenticated exploitation is not possible given PR:L in the CVSS vector.

The CVSS 3.0 score of 4.4 (Medium) accurately reflects the constrained exploitability: AC:H captures the attacker's incomplete control over payload firing, PR:L requires the attacker to hold authenticated low-privilege access, and UI:R mandates that an administrator actively use the affected maintenance tools. No EPSS data was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. The S:C flag elevates real-world impact above what the base score suggests - successful exploitation grants the attacker capabilities within the admin's authenticated context, enabling actions like creating rogue admin accounts or exfiltrating configuration data. The primary limiting factor is the indirect, multi-step delivery chain: the attacker cannot force an administrator to run the maintenance tools. This significantly reduces urgency compared to direct admin-targeting XSS vectors, though the persistent payload remains a latent risk as long as the entity names are stored.

An attacker with a low-privilege Revive Adserver account creates or renames an ACL zone or banner entity with a name containing a JavaScript payload (e.g., an event handler or script tag). No public proof-of-concept code has been identified, but the attack requires no special tooling beyond a standard browser. When an administrator subsequently navigates to the maintenance-acl-check.php or maintenance-banners-check.php tool to audit inconsistencies, the stored payload renders in the admin's browser without escaping, executing JavaScript in the admin session context and potentially exfiltrating session cookies or triggering privileged API calls.