What is the CVSS score of EUVD-2026-38500?

EUVD-2026-38500 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Revive Adserver are affected by EUVD-2026-38500?

Revive Adserver versions 6.0.6 and earlier contain an authenticated code injection vulnerability that allows low-privilege users to execute arbitrary PHP code through the ad-delivery infrastructure.

How to fix or mitigate EUVD-2026-38500?

24 hours: Inventory all Revive Adserver deployments and identify instances running version 6.0.6 or earlier; document user access permissions to delivery configuration. 7 days: Restrict administrative privileges for delivery-limitation settings to senior staff only; implement network segmentation to isolate ad-server infrastructure; contact vendor for patched version availability. 30 days: Execute upgrade to Revive Adserver 6.0.7 or later when available; if patch timeline extends beyond 60 days, evaluate alternative ad-serving platforms or temporary infrastructure migration.

Revive Adserver EUVD-2026-38500

| CVE-2026-44959 HIGH

Code Injection (CWE-94)

2026-06-23 hackerone

GHSA-h4mp-fxvg-qvvr

PHP RCE Code Injection Adserver Revive

8.8

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable admin UI, low complexity, requires a low-privileged Revive account (PR:L), no user interaction, and stored PHP execution yields full host-process CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 17:02 vuln.today

DescriptionCVE.org

A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery. Input sanitisation has been improved to ensure that unexpected parameters are filtered out.

Articles & Coverage 2

News 4 New PHP Vulnerabilities - 4 High Severity, No Public POC Jun 24, 2026 News 3 New PHP Vulnerabilities - 3 High Severity Jun 23, 2026

AnalysisAI

Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpected parameter into the delivery limitations save flow, planting attacker-controlled PHP into the compiledlimitations field that is then evaluated when banners are served. With CVSS 8.8 and a CWE-94 root cause, successful exploitation yields full code execution under the web/ad-delivery process, though there is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV.

Technical ContextAI

Revive Adserver is an open-source PHP ad-serving platform descended from OpenX. Delivery limitations are persisted as a precompiled PHP expression in the compiledlimitations column, which the delivery engine evaluates at banner-serving time to decide whether a creative is shown. The flaw, classified as CWE-94 (Improper Control of Generation of Code), stems from accepting an unexpected component parameter during the save-limitations action and weaving its value into that compiled PHP without filtering, so attacker-controlled syntax becomes part of the code the delivery layer runs. The affected component is identified by CPE cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*, covering all Revive Adserver versions up to and including 6.0.6.

RemediationAI

Upgrade to the Revive Adserver release that follows 6.0.6 and contains the improved input sanitisation that filters unexpected parameters out of the delivery-limitations save path; the input notes the fix conceptually but does not supply an exact patched version number, so confirm the target release against the vendor download page and the HackerOne report at https://hackerone.com/reports/3744200 before deploying. Until patched, restrict who can create or edit banner delivery limitations by limiting low-privileged advertiser/agency account provisioning, place the Revive admin UI behind VPN or IP allow-listing so untrusted users cannot reach the save endpoint, and audit the compiledlimitations column for suspicious PHP fragments before re-enabling delivery; each of these reduces attack surface at the cost of administrative overhead and, for IP allow-listing, blocking legitimate remote advertiser self-service.