Revive Adserver EUVD-2026-38503

Exploitation requires both conditions to be met simultaneously: the attacker must control a username within the Revive Adserver instance - either via self-registration if enabled, or via an existing authenticated low-privilege account - and an administrator must actively navigate to the audit log details view for log entries associated with that username. Exploitation is limited by the user-interaction dependency (the admin must open the specific audit log detail record) and by the need to introduce the payload through an account-linked username. If self-registration is disabled, the attacker requires at minimum a pre-existing low-privilege account to set the malicious username; unauthenticated exploitation is not supported by the available data.

Real-world risk within Revive Adserver deployments is moderate to high despite the absence of a CVSS score and KEV listing. The attack primitive - stored XSS triggered in an admin context - is well-understood and consistently weaponizable for session hijacking or privilege abuse. No EPSS score is available in the input data, and the vulnerability has not been confirmed as actively exploited. The null CVSS vector should not be used for prioritization; this analysis derives an independent score below. A meaningful limiting factor is the two-stage dependency: the attacker must control a username in the system (requiring at minimum low-privilege account access or an open self-registration feature), and an administrator must then view the specific audit log details entry. The admin-interaction requirement prevents fully automated mass exploitation, but reviewing audit logs is a routine task in any actively managed platform, making the trigger realistic rather than theoretical.

An attacker with a low-privilege account on the Revive Adserver instance sets their username to a JavaScript payload - for example, a cookie-exfiltration script targeting the admin session. The attacker then performs any platform action that generates an audit log entry attributed to their username. When an administrator later navigates to audit log details for those entries, the username is rendered without escaping, the JavaScript executes in the admin's browser, and the attacker receives the admin session token, gaining full administrative access.