Revive Adserver: Reflected cross-site scripting in invocation-tag generation
Summary
Revive Adserver 6.0.8 and earlier contains a reflected cross-site scripting (XSS) flaw in the invocation-tag generation interface. When Direct Selection is enabled, which is not the default, an attacker-controlled banner identifier is placed into HTML form fields without proper encoding. An unauthenticated attacker can make an authenticated user, typically an administrator, run JavaScript in the browser by luring them to a crafted URL.
Affected
- Revive Adserver 6.0.8 and earlier
- Only when Direct Selection is enabled (disabled by default)
Fixed in
- Revive Adserver 6.0.9 (HTML-encodes banner identifier values in the invocation-option form fields)
- Whether earlier 6.0.x branches received backports: Unknown.
Workaround
- No vendor workaround published. Confirm that Direct Selection is disabled.
- Restrict access to the admin UI to trusted networks.
Exploitation
- Not known to be exploited. No CISA KEV listing reported by aggregator data.
- No public proof of concept found.
Our recommendation
- Upgrade Revive Adserver to 6.0.9.
- Check that Direct Selection is disabled.
- Make sure the admin UI is not reachable from the internet.
- Ask administrators not to open untrusted links while logged in to the admin UI.
- Re-check the HackerOne report and NVD once analysis is published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-108564 www.cve.org
- HackerOne Report 3942028 hackerone.com
- Strix AI CVE-2026-108564 www.strix.ai
- OffSeq Radar CVE-2026-108564 radar.offseq.com
- HackerOne Revive Adserver Bug Bounty Program hackerone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:12.
Original description (NVD)
A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.