Revive Adserver: Stored cross-site scripting in append-code maintenance page
Summary
A stored cross-site scripting (XSS) vulnerability in the append-code maintenance page of Revive Adserver allows an authenticated manager to run JavaScript in an administrator's browser. The manager stores a malicious tracker name that is shown unencoded when an administrator opens the maintenance results. A successful attack could allow actions in the admin panel or theft of the administrator's session on the ad server. The attack requires a manager account and an administrator opening the affected page.
Affected
- Revive Adserver 0 through 6.0.8
Fixed in
- Revive Adserver 6.0.9 (according to the CVE record; vendor release notes not yet verified)
Workaround
Unknown.
Exploitation
- Not known to be exploited.
- No public proof of concept found at the time of research.
Our recommendation
- Upgrade Revive Adserver to 6.0.9 or later once the release has been verified on the vendor download page.
- Restrict manager and administrator accounts to trusted staff and review existing accounts for unknown users.
- Enforce multi-factor authentication for admin accounts.
- Limit access to the admin interface to internal networks or VPN.
- Monitor for unexpected changes to tracker names.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-108562 www.cve.org
- HackerOne report 3826207 hackerone.com
- OffSeq Radar CVE-2026-108562 radar.offseq.com
- Strix CVE-2026-108562 www.strix.ai
- Revive Adserver GitHub file maintenance-appendcode-check.php github.com
- Revive Adserver FAQ www.revive-adserver.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:33.
Original description (NVD)
A stored cross-site scripting vulnerability in maintenance-appendcode-check.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to execute JavaScript in an administrator's browser. A manager can store a malicious tracker name and cause the tracker to appear in the append-code maintenance results. When an administrator opens the affected maintenance page, the tracker name is included in HTML without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding tracker names when displaying the maintenance results.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.