CVE-2026-50742: Stored XSS in Revive Adserver 6.0.7 Maintenance Tools

Technical summary

The vulnerability stems from insufficient output encoding in the maintenance diagnostic tools of Revive Adserver. When ACL or banner inconsistencies are detected, entity names are rendered directly into the HTML response without HTML entity encoding or other sanitization. An attacker who can influence entity names in the database (through prior compromise or normal application functionality) can embed JavaScript payloads that execute in the context of an administrator's session when maintenance checks are run. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) reflects that the attack requires network access, low complexity, prior authenticated access to the system, user interaction (admin running the tool), but crosses security boundaries with limited confidentiality and integrity impact.

Business impact

This vulnerability poses a moderate risk to Revive Adserver operators. Compromised administrator sessions could lead to unauthorized changes to ad serving configurations, access to sensitive advertising data, or further lateral movement within the ad infrastructure. However, exploitation requires an administrator to actively run the maintenance tools after the attacker has seeded malicious data—this dual requirement raises the execution bar compared to fully automatic attacks. Organizations relying on Revive Adserver for critical ad operations should treat this as a priority fix to prevent administrative compromise.

Affected systems

Revive Adserver version 6.0.7 is confirmed vulnerable. The vulnerability affects both the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools. Any deployment of this version that exposes these maintenance interfaces to authenticated administrators is at risk. Verify your installed version and patch status against the vendor advisory.

Exploitability

Exploitation requires three conditions: (1) the attacker must have some means to inject or influence entity names stored in the Revive Adserver database; (2) an administrator must authenticate to the system; and (3) that administrator must run one of the affected maintenance tools. The first condition may be satisfied through database access, a separate vulnerability, or legitimate application features that allow data modification. Because the attacker cannot directly trigger tool execution, opportunistic timing or social engineering of administrators to run these diagnostics may be necessary. The vulnerability is not remotely exploitable without prior access or database manipulation.

Remediation

Update Revive Adserver to a patched version released after 6.0.7. Consult the vendor's security advisory for the specific version that resolves CVE-2026-50742. As an interim measure, restrict access to the maintenance tools (`maintenance-acl-check.php` and `maintenance-banners-check.php`) to trusted administrators or a secured IP range, and monitor for suspicious entity names in the database that may contain script tags or event handlers.

Patch guidance

Apply the security update provided by Revive Adserver for this vulnerability. Test the patch in a staging environment first, then deploy to production. Verify that the maintenance tools properly escape entity names after patching. Review recent maintenance tool logs to determine if malicious payloads may have been executed against your administrators.

Detection guidance

Monitor for HTTP requests to `maintenance-acl-check.php` and `maintenance-banners-check.php` from administrator accounts, particularly combined with database modifications that introduce entity names containing HTML special characters, JavaScript event handlers (e.g., `onerror=`, `onclick=`), or script tags. Examine access logs for repeated or unusual calls to these tools. Review stored entity names in the Revive Adserver database for payloads such as `<script>`, `javascript:`, or event handler attributes.

Why prioritize this

Although assigned a MEDIUM severity score, this vulnerability merits prompt attention because it directly targets administrative accounts and can lead to session hijacking or unauthorized configuration changes in ad infrastructure. The dual-requirement exploit path (database access + admin tool use) makes it less immediately critical than a remote code execution flaw, but the consequences of successful exploitation—loss of administrative control—justify treating it as a priority fix within the next 1–2 weeks.

Risk score, explained

CVSS 3.1 score of 5.4 (MEDIUM) reflects that the attack is network-accessible with low complexity, but requires prior authentication (PR:L), user interaction (UI:R), and crosses a security boundary (S:C), resulting in limited confidentiality and integrity impact (C:L/I:L) with no availability impact. The score appropriately penalizes the need for an administrator to manually trigger the vulnerable code path, which is outside the attacker's direct control.

Frequently asked questions