Is CVE-2026-34916 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34916 being exploited in the wild.

How severe is CVE-2026-34916?

High severity, with a CVSS score of 8.8, published 23 June 2026.

Which products and versions are affected?

Revive-Adserver Adserver 6.0.6 and earlier.

Is there a fix for CVE-2026-34916?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34916 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34916?

Check whether you run Revive-Adserver Adserver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34916: Revive Adserver PHP code injection in delivery limitations

CVE-2026-34916 · Severity: high · CVSS 8.8 · Published 2026-06-23

Revive Adserver, a popular open-source platform for managing digital advertising, contains a security flaw that allows users with low-level access to execute malicious code on the server. By manipulating how delivery limitations are saved, an attacker can gain full control over the system, potentially leading to data theft, service disruption, or the distribution of malicious advertisements. This vulnerability poses a significant risk to the integrity of the advertising platform and the security of the underlying server infrastructure.

Technologies: Revive-Adserver Adserver. Vendors: Revive-Adserver.

Quick answers

Is CVE-2026-34916 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34916 being exploited in the wild.
How severe is CVE-2026-34916?: High severity, with a CVSS score of 8.8, published 23 June 2026.
Which products and versions are affected?: Revive-Adserver Adserver 6.0.6 and earlier.
Is there a fix for CVE-2026-34916?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34916 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34916?: Check whether you run Revive-Adserver Adserver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability (CWE-94) exists in Revive Adserver versions 6.0.6 and earlier due to insufficient validation of the 'logical' parameter when saving delivery limitations. An authenticated attacker with low-level privileges can inject malicious PHP code into the 'compiledlimitations' database field. This code is subsequently executed by the server during the banner delivery process. The attack is reachable over the network and does not require user interaction, though it does require valid (low-privileged) credentials. The issue has been addressed by improving input sanitization to ensure the parameter is properly validated.

Affected products

Revive Adserver Revive Adserver 6.0.6 and earlier

Timeline

2026-06-23: advisory: NVD publication date
2026-06-23: disclosed: HackerOne report published

References

https://hackerone.com/reports/3656781

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.