User Input Validation Flaw in Revive Adserver Affects Ad Delivery Security
CVE-2026-44959

8.8HIGH

Key Information:

Vendor

Revive

Status
Adserver
Vendor
CVE Published:
23 June 2026

What is CVE-2026-44959?

A security flaw in Revive Adserver allows low-privileged users to manipulate delivery limitations by injecting unexpected parameters. This could lead to the execution of malicious PHP code during banner delivery. Although input sanitization has been enhanced to filter out unauthorized parameters, users of Revive Adserver versions prior to 6.0.7 are urged to review their settings and apply necessary updates to mitigate potential security risks.

Affected Version(s)

Adserver 0 <= 6.0.6

References

https://hackerone.com/reports/3744200

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

rajib_mahmud
.