Revive Adserver EUVD-2026-39604

Exploitation requires a victim user to click or otherwise navigate to a specifically crafted URL that includes the malicious refresh parameter pointing to zone-include.php (UI:R per CVSS - not automatable). A critical discrepancy exists in the input data: the provided CVSS vector specifies PR:N (no prior authentication needed), but the CVE description states 'a low-privileged user could exploit' - this implies that a valid account on the Revive Adserver instance may be required to access zone-include.php, or that the exploiting actor must hold a low-privileged role. Authentication requirements are not independently confirmed from available data and should be verified against the HackerOne report. The limiting factors for exploitation are: the need for victim interaction (clicking a crafted link), potential authentication prerequisite for zone access, and the niche deployment footprint of Revive Adserver in production environments.

The NVD-assigned CVSS 3.0 score of 6.1 (Medium) is based on AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. A notable inconsistency exists in the input data: the CVSS vector assigns PR:N (no privileges required), yet the CVE description explicitly states 'a low-privileged user could exploit' - suggesting some form of authentication may be a prerequisite. This discrepancy should be verified against the vendor advisory at the HackerOne report. The S:C (scope change) elevates the score above a typical reflected XSS because script execution crosses the browser security boundary. The UI:R requirement reduces automated exploitability, as a victim must interact with a crafted link. No EPSS score was provided in the available data. There is no CISA KEV listing and no known public exploit code, placing real-world priority lower than the CVSS alone might suggest - particularly given Revive Adserver's niche deployment footprint.

An attacker with a low-privileged account on a Revive Adserver instance crafts a URL targeting zone-include.php with a JavaScript payload embedded in the refresh parameter, then distributes this link to a higher-privileged user (e.g., an administrator) via phishing or a message within the platform. When the victim clicks the link, the unsanitized refresh value is reflected into the response page and executed in their browser, potentially capturing session cookies or performing actions on behalf of the victim. No public exploit code has been identified at time of analysis, but the attack requires only basic XSS knowledge given the low attack complexity (AC:L) indicated in the CVSS vector.