CVE-2026-44959: Revive Adserver Code Injection in Delivery Limitations—CVSS 8.8 HIGH

Technical summary

CVE-2026-44959 is a code injection vulnerability (CWE-94) affecting Revive Adserver 6.0.6 and earlier. The vulnerability exists in the delivery limitations configuration mechanism, where the application fails to validate unexpected component parameters before storing them in the compiledlimitations field. An authenticated low-privileged user can craft malicious input containing PHP code that bypasses validation filters. During banner delivery, the unsanitized data is processed and executed as PHP, enabling remote code execution. The fix involves filtering out unexpected parameters and improving input sanitization to prevent injection payloads from reaching the compiled limitations storage.

Business impact

Successful exploitation allows attackers with user-level accounts to execute arbitrary code on ad servers running vulnerable versions of Revive Adserver. This can lead to full server compromise, including data theft, malware installation, lateral movement into the network, and denial of service. Ad servers are often positioned between publishers and advertisers, making them valuable pivots for supply-chain attacks. Compromised ad infrastructure can distribute malware to thousands of websites, damage publisher relationships, and expose sensitive advertiser and user data. Organizations relying on Revive Adserver should treat this as a critical infrastructure issue.

Affected systems

Revive Adserver versions 6.0.6 and earlier are vulnerable. The vulnerability requires an authenticated account with low-privileged access, so it affects deployments where user registration is enabled or where internal staff have limited accounts. Self-hosted Revive Adserver instances are directly at risk; SaaS deployments depend on whether the vendor has patched their infrastructure. Verify your current version immediately to determine exposure.

Exploitability

The vulnerability is readily exploitable for users who already have authenticated access to Revive Adserver. No user interaction or special privileges are required beyond basic account creation. The attack vector is network-based and can be executed remotely. The low barrier to exploitation—combined with the high impact of code execution—makes this vulnerability attractive to attackers. Malicious insiders, compromised contractor accounts, or brute-forced credentials pose immediate risk. There is no indication in available data that this vulnerability is currently exploited in the wild or included in automated threat databases.

Remediation

Organizations must upgrade Revive Adserver to a patched version that addresses input validation in the delivery limitations feature. Verify the specific patch version from the vendor's security advisory before deployment. As an interim mitigation, restrict user account creation and audit existing user accounts for suspicious activity. Implement network segmentation to limit the impact of code execution on the ad server, and monitor banner delivery logs and server execution for signs of injected code. Consider running Revive Adserver in a containerized environment with restricted permissions to reduce blast radius.

Patch guidance

Contact Revive Adserver support or consult their official security advisory for the patched version number and release notes. Apply the patch to all Revive Adserver instances running version 6.0.6 or earlier. Verify patch deployment by confirming the version number in the application settings and testing the delivery limitations feature to ensure input validation is now enforced. If you maintain a private or forked version of Revive Adserver, apply the vendor's input sanitization improvements to your codebase and conduct code review to identify similar vulnerabilities.

Detection guidance

Monitor server logs for unusual activity in the Revive Adserver delivery limitations configuration, such as API requests containing PHP code snippets, serialized objects, or escaped characters in the component parameter. Alert on any changes to the compiledlimitations field in the database that contain PHP keywords (eval, system, exec, passthru, etc.). Implement Web Application Firewall (WAF) rules to block requests containing PHP code patterns submitted to the delivery limitations endpoint. Review audit logs for account creation and privilege changes, especially in public or low-security deployments. If you lack detailed logging, enable verbose logging for the ad server configuration module immediately.

Why prioritize this

This vulnerability merits high priority remediation because it enables unauthenticated-adjacent code execution (requires only basic user credentials), affects ad infrastructure serving content to millions of users, and has broad security implications across the supply chain. The CVSS 3.0 score of 8.8 reflects the combination of network accessibility, low complexity, and high impact on confidentiality, integrity, and availability. While currently not in the CISA Known Exploited Vulnerabilities catalog, the simplicity of exploitation and the valuable position of ad servers in the attack chain suggest threat actors will attempt to weaponize it once patches are widely available.

Risk score, explained

The CVSS 3.0 score of 8.8 (HIGH severity) reflects: (1) Network accessibility—attacks originate from the network without requiring local access; (2) Low attack complexity—no special tools or conditions are needed to exploit once credentials exist; (3) Low privileges required—a basic user account is sufficient; (4) No user interaction—the attack executes automatically; (5) High impact across all security pillars—confidentiality, integrity, and availability are all compromised by arbitrary code execution. The score appropriately penalizes the authentication requirement, but the ease of obtaining low-privileged credentials in many deployments reduces the practical security gap.

Frequently asked questions