Revive Adserver: Formula injection in conversion report XLS exports
Summary
Revive Adserver writes conversion values into XLS report exports without neutralising spreadsheet formulas. An unauthenticated attacker can submit conversion values that are stored as formulas, and these can be evaluated when a user opens the exported report in a spreadsheet application. The confirmed impact is formula execution within the workbook; disclosure of information to the attacker has not been established. The user must open the exported file, so exploitation depends on that interaction.
Affected
- Revive Adserver 0 to 6.0.8 (per the CNA record; affected range stated as up to and including 6.0.8)
Fixed in
- Revive Adserver 6.0.9 (sanitises conversion values before writing them to the affected XLS report sections)
Workaround
- No vendor workaround documented.
- Interim measures: limit who can export conversion reports; open exported files with external content and macros disabled; treat cells beginning with =, +, -, or @ as suspicious.
Exploitation
- Unknown. No public proof of concept found in the research.
- One aggregator states it is not known to be exploited; not independently verified.
Our recommendation
- Upgrade to Revive Adserver 6.0.9 and schedule it soon, because the same release also fixes CVE-2026-107662 (blind SQL injection, CVSS 8.8, requires an authenticated manager).
- Until then, restrict conversion report exports and open exported XLS files with macros and external content disabled.
- Check whether your Revive instance is internet-facing and which versions are running.
- Verify the fix against the vendor advisory once published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HackerOne report 3859000 hackerone.com
- Revive Adserver security page www.revive-adserver.com
- Strix: CVE-2026-108563 www.strix.ai
- Threat Intelligence: CVE-2026-108563 cve.threatint.com
- OffSeq Radar: CVE-2026-108563 radar.offseq.com
- Strix: CVE-2026-107662 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:13.
Original description (NVD)
Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet application, attacker-supplied formulas can be evaluated. The confirmed impact is formula execution within the workbook; disclosure of information to the attacker has not been established. The issue is fixed in Revive Adserver 6.0.9 by sanitising conversion values before writing them to the affected XLS report sections.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.