Revive Adserver EUVD-2026-38501

The attacker must hold a valid authenticated account on the target Revive Adserver instance with at least low-privileged zone management permissions (PR:L per CVSS). The exploitation path requires invoking either the zone-include.php script or the API endpoint responsible for zone-to-banner or zone-to-campaign linkage - both are accessible over the network (AV:N) with no special configuration needed beyond a functioning multi-user installation. The primary limiting factor is the requirement for an existing account on the same instance; unauthenticated external attackers cannot exploit this vulnerability. Impact is further bounded to integrity corruption of ownership relationships - no credentials, session data, or confidential content are exposed, and service availability is unaffected. Single-tenant deployments where only a single trusted advertiser operates are not meaningfully exposed.

The CVSS 3.0 score of 4.3 (Medium) accurately reflects the constrained impact: network-accessible (AV:N), low complexity (AC:L), requiring a low-privileged account (PR:L), with integrity-only impact (I:L) and no confidentiality or availability consequence. No EPSS score was provided in the input, and the absence of a CISA KEV listing combined with no identified public exploit code indicates this has not seen widespread or confirmed active exploitation. Real-world risk is moderate and context-dependent: exploitation is limited to authenticated users on the same Revive Adserver instance, making external attackers irrelevant. The highest-risk scenario is shared or SaaS-style deployments where competing advertisers share an instance. The business impact is advertising disruption rather than data breach or system compromise. SSVC assessment: exploitation not confirmed active; the attack is automatable via API once access is established; technical impact is partial (integrity corruption of ownership data only). This is a genuine but non-urgent patching priority for multi-tenant deployments.

An authenticated low-privileged advertiser on a shared Revive Adserver instance enumerates valid banner or campaign IDs belonging to a competitor by observing existing ads or leveraging any ID disclosure in the interface, then submits a crafted HTTP request to zone-include.php or the equivalent API endpoint specifying their own zone ID alongside the victim's banner or campaign ID. The server, lacking an ownership check, accepts the linkage and begins serving the victim's creative assets from the attacker's zones, effectively hijacking the victim's campaign delivery. No public proof-of-concept code has been identified, but the attack requires only standard HTTP requests and knowledge of valid IDs.