# CVE-2026-50743: Revive Adserver CSRF in zone-include.php

Source: https://junglewise.ai/threats/cve-2026-50743-revive-adserver-csrf-in-zone-include-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-50743 · Severity: medium · CVSS 5.4 · Published 2026-07-20

Revive Adserver, a popular open-source advertising server, is vulnerable to a security flaw that could allow an attacker to manipulate advertising campaigns. By tricking an authenticated administrator into clicking a malicious link, an attacker can link or unlink banners and campaigns to specific zones without the administrator's knowledge. This could lead to unauthorized changes in ad delivery, potentially disrupting revenue or displaying unintended content.

Technologies: [Revive-Adserver Adserver](https://junglewise.ai/threats/technologies/adserver). Vendors: [Revive-Adserver](https://junglewise.ai/threats/vendors/revive-adserver).

## Quick answers

**Is CVE-2026-50743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50743 being exploited in the wild.

**How severe is CVE-2026-50743?** Medium severity, with a CVSS score of 5.4, published 20 July 2026.

**Which products and versions are affected?** Revive-Adserver Adserver 6.0.7 and earlier.

**Is there a fix for CVE-2026-50743?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50743 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50743?** Check whether you run Revive-Adserver Adserver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the `zone-include.php` script of Revive Adserver version 6.0.7 and below. The application fails to verify CSRF tokens for GET and POST requests that manage the association between banners/campaigns and zones. An attacker can exploit this by inducing an authenticated administrator to visit a malicious webpage or click a link, triggering unauthorized state-changing actions. This allows for the unauthorized linking or unlinking of advertising assets, impacting the integrity and availability of ad delivery configurations.

## Affected products

- Revive Adserver 6.0.7 and earlier

## Timeline

- 2026-07-20: disclosed: CVE published to NVD via HackerOne report

## References

- [https://hackerone.com/reports/3781691](https://hackerone.com/reports/3781691)

## Related threats

- [Revive Adserver reflected XSS in stats-video.php](https://junglewise.ai/threats/cve-2026-50745-revive-adserver-reflected-xss-in-stats-video-php)
- [Revive Adserver auth bypass in XML-RPC API](https://junglewise.ai/threats/cve-2026-50744-revive-adserver-auth-bypass-in-xml-rpc-api)
- [Revive Adserver stored XSS in maintenance tools](https://junglewise.ai/threats/cve-2026-50742-revive-adserver-stored-xss-in-maintenance-tools)
- [Revive Adserver code injection bypass in XML-RPC API](https://junglewise.ai/threats/cve-2026-50741-revive-adserver-code-injection-bypass-in-xml-rpc-api)
- [Revive Adserver reflected XSS in zone-include.php](https://junglewise.ai/threats/cve-2026-50740-revive-adserver-reflected-xss-in-zone-include-php)