CVE-2026-34916: Revive Adserver PHP Code Injection via Delivery Limitations

Technical summary

CVE-2026-34916 is a PHP code injection vulnerability (CWE-94: Improper Control of Generation of Code) affecting Revive Adserver 6.0.6 and earlier. When saving delivery limitations, the logical parameter is not properly validated before being stored in the compiledlimitations database field. During banner delivery, the stored content is executed as PHP code, allowing an attacker with low-privilege access to inject arbitrary code. The vulnerability requires authentication and does not require user interaction, resulting in a CVSS 3.0 score of 8.8 (HIGH severity) with network-accessible impact affecting confidentiality, integrity, and availability.

Business impact

This vulnerability enables authenticated attackers to establish persistent code execution on ad-serving infrastructure. An attacker could steal advertiser data, modify banner content to redirect traffic or serve malware, disrupt ad campaigns, or use the compromised server as a pivot point into the broader network. For organizations running Revive Adserver—particularly ad networks, agencies, and publishers—this represents a direct threat to revenue operations, brand reputation, and customer trust. The ability to modify banner delivery means attackers could silently alter advertising behavior, leading to undetected fraud or data exfiltration.

Affected systems

Revive Adserver versions 6.0.6 and earlier are affected. Vendor product information is not yet cataloged in the source data; consult the official Revive Adserver security advisory to confirm the complete version matrix. Any deployment where low-privileged users have access to the delivery limitations configuration interface is at risk. This includes self-hosted instances and managed deployments that have not applied the patched version.

Exploitability

The vulnerability requires valid authentication credentials and low privilege level access, making it exploitable by a disgruntled employee, compromised account, or lateral-movement attacker who has already gained initial access to the ad server environment. No user interaction is required and the attack is network-accessible, meaning exploitation can occur remotely. The logical parameter manipulation is straightforward to execute once privilege is obtained, making this a practical and reliable attack vector. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, but the simplicity of exploitation and the high value of ad server compromise suggest it is likely to be weaponized.

Remediation

Upgrade Revive Adserver to a patched version that includes improved input sanitization for the logical parameter. Verify the specific patched version number against the official Revive Adserver security advisory. Until patching is possible, implement strict access controls to limit who can modify delivery limitation settings, restrict network access to the ad server management interface, and monitor database and log activity for suspicious parameter patterns. Consider temporarily disabling the delivery limitation feature if it is not critical to operations.

Patch guidance

Apply the vendor's patched version of Revive Adserver as soon as possible. The fix includes proper validation of the logical parameter before database storage. Organizations should test the patch in a staging environment to ensure compatibility with existing ad campaigns and customizations before deploying to production. Verify the patch version against the official Revive Adserver security bulletin to ensure authenticity. Monitor the application logs after patching to confirm that the validation is functioning correctly.

Detection guidance

Search for suspicious patterns in logs and database queries targeting the compiledlimitations field. Look for user activity modifying delivery limitation settings from unusual locations or at unusual times. Monitor for error logs or warnings related to PHP execution or parameter validation failures. Database audit logs may reveal INSERT or UPDATE statements containing PHP code fragments or suspicious serialized objects in the logical parameter. Additionally, monitor banner serving infrastructure for unexpected PHP execution errors or performance anomalies that could indicate injected code execution.

Why prioritize this

This vulnerability merits immediate patching due to its high CVSS score (8.8), the low authentication requirement, and the severe impact on confidentiality, integrity, and availability. Revive Adserver is critical infrastructure for advertising operations, and code execution on such systems directly threatens customer data, advertising integrity, and business continuity. The attack is practical and does not require sophisticated exploitation techniques. Organizations running affected versions should treat this as a critical security priority.

Risk score, explained

The CVSS 3.0 score of 8.8 (HIGH) reflects network-accessible attack surface, low privilege requirement, no user interaction needed, and maximum impact across all three security objectives. The vulnerability allows full code execution in the context of the application, enabling attackers to read, modify, or delete any data accessible to the Revive Adserver process. While authentication is required, the low privilege level means the risk extends beyond administrators to a broader class of users, substantially increasing exposure.

Frequently asked questions