# CVE-2026-108559: Revive Adserver reflected cross-site scripting in iframe invocation

Source: https://junglewise.ai/threats/cve-2026-108559-a-reflected-cross-site-scripting-vulnerability-in-the-iframe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-108559 · Severity: medium · CVSS 6.1 · Published 2026-11-11

Revive Adserver is a web-based ad serving platform that manages and delivers online advertisements. An unauthenticated attacker can inject malicious JavaScript that executes in a logged-in user's browser by tricking them into visiting a crafted URL. Successful exploitation allows the attacker to steal session data, modify ad configurations, or compromise advertiser accounts.

Technologies: [Revive-Adserver Revive Adserver](https://junglewise.ai/threats/technologies/adserver). Vendors: [Revive-Adserver](https://junglewise.ai/threats/vendors/revive-adserver).

## Quick answers

**Is CVE-2026-108559 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108559 being exploited in the wild.

**How severe is CVE-2026-108559?** Medium severity, with a CVSS score of 6.1, published 11 November 2026.

**Which products and versions are affected?** Revive-Adserver Revive Adserver 6.0.8 and earlier.

**Is there a fix for CVE-2026-108559?** Yes: fixed in Revive Adserver 6.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108559 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108559?** Check whether you run Revive-Adserver Revive Adserver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Revive Adserver 6.0.9

## Technical details

A reflected XSS vulnerability exists in the iframe invocation options where frame_width and frame_height parameters are inserted into HTML attributes without proper encoding. An unauthenticated attacker can craft a malicious URL that injects JavaScript, which executes when an authenticated user visits the link. The vulnerability requires user interaction (visiting the malicious URL) and affects the invocation-tag generation for any-size zones.

## Affected products

- Revive Adserver Revive Adserver 6.0.8 and earlier

## Timeline

- 2026-11-11: disclosed

## References

- [https://hackerone.com/reports/3908050](https://hackerone.com/reports/3908050)

## Related threats

- [Revive Adserver stored cross-site scripting in maintenance page](https://junglewise.ai/threats/cve-2026-108562-a-stored-cross-site-scripting-vulnerability-in-maintenance)
- [Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.](https://junglewise.ai/threats/cve-2025-55124-improper-neutralisation-of-input-in-revive-adserver-6-0-0-causes)
- [Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be…](https://junglewise.ai/threats/cve-2025-55123-improper-neutralization-of-input-in-revive-adserver-5-5-2-and-6-0)
- [Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions…](https://junglewise.ai/threats/cve-2025-52671-debug-information-disclosure-in-the-sql-error-message-to-in)
- [SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted…](https://junglewise.ai/threats/cve-2025-52664-sql-injection-in-revive-adserver-6-0-0-causes-potential)