Revive Adserver EUVD-2026-46027

Exploitation requires that the targeted user holds an active, authenticated Revive Adserver administrator session at the time of the attack - the forged request relies on the browser automatically including the session cookie. The victim must be induced to visit an attacker-controlled page or open a crafted URL while logged in (UI:R). The zone-include.php script must be network-reachable from the attacker's delivery origin, which is typically the case for any internet-facing Revive Adserver installation. No special non-default configuration of the ad server is required; the vulnerability exists in the default administrative zone management functionality for all versions through 6.0.7. Limiting factors include: the attack cannot exfiltrate data (C:N), the impact is scoped to ad configuration changes rather than system access, and it requires social engineering of a specific privileged user rather than automated scanning exploitation.

The CVSS 3.0 base score of 5.4 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L accurately reflects the constrained real-world impact: the attack requires an active, authenticated administrator session and user interaction (UI:R), limiting opportunistic mass exploitation. The integrity and availability impacts are both rated Low, confined to ad zone configuration changes rather than system compromise or data exfiltration. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified. Overall, this is a genuine but limited-priority finding: the blast radius is restricted to ad delivery disruption and configuration tampering, not credential theft or remote code execution. Organizations running Revive Adserver in production should prioritize patching given the trivial exploit complexity once an admin is socially engineered, but this does not warrant emergency response posture.

An attacker registers a domain and hosts a page containing a hidden HTML form or an img tag whose src attribute points to the target Revive Adserver instance's zone-include.php with parameters designed to unlink a high-value banner campaign from all delivery zones. The attacker then sends the link to a Revive Adserver administrator via phishing email; when the administrator opens the link while their admin session is active, the browser silently submits the forged request and the campaign is disrupted without any visible indication to the admin.