Revive Adserver EUVD-2026-38506

Exploitation requires (1) network reachability to the Revive Adserver web interface, (2) valid credentials for any low-privileged Revive account that can reach zone-include.php (PR:L per the CVSS vector - anonymous exploitation is NOT indicated), and (3) the target running Revive Adserver 6.0.6 or earlier with the unsanitised clientid code path present. Limiting factors: the attack is blind (no direct query output), so data exfiltration is inference-based and slower; no user interaction is needed (UI:N); and deployments that disable self-service account registration or that front the admin UI with IP allow-listing materially reduce the realistic attacker pool.

The CVSS:3.0 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H reflects a network-reachable, low-complexity attack requiring only low-privileged authentication and no user interaction, with high integrity and availability impact and limited confidentiality impact - consistent with blind SQLi where data extraction is slower but write/destroy operations are straightforward. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public PoC is referenced beyond the HackerOne report URL, so real-world exploitation pressure cannot be directly quantified. The PR:L requirement meaningfully constrains opportunistic mass exploitation, but in multi-tenant ad-server deployments (where untrusted advertisers or agencies hold low-privileged accounts) the prerequisite is trivially satisfied, making this a genuine priority rather than a paper-tiger high-CVSS issue.

An attacker who registers or compromises any low-privileged Revive account - for example an advertiser or trafficker login in a shared publisher instance - issues authenticated requests to zone-include.php supplying a crafted clientid value containing boolean- or time-based SQL payloads. Because the response is blind, the attacker uses inference (e.g., conditional SLEEP() or IF()-based content differences) to enumerate the database, extract admin password hashes from the rv_users table, or modify campaign records to redirect traffic to malicious creatives.