Revive Adserver: Authorization bypass in campaign-zone linking
Summary
Revive Adserver 6.0.8 and earlier lets an authenticated manager, or a trafficker with zone-linking permissions, link another agency's campaign to their own zone. Missing ownership checks in the bulk and single-link operations and in the XML-RPC campaign-linking method allow this. Agency filtering still blocks foreign banners, but the foreign campaign's name, type and identifier can appear in the linked-campaign listing, so the main impact is information disclosure and distorted ad delivery and reporting.
Affected
- Revive Adserver 0 to 6.0.8
Fixed in
- Revive Adserver 6.0.9, which validates campaign ownership in the affected operations
Workaround
- No vendor workaround known.
- Interim measure (not from the vendor): restrict access to the admin interface to known management IP addresses or a VPN until the upgrade is complete.
Exploitation
- Not known to be exploited.
- No public proof of concept found.
- VulDB states no exploit is available.
Our recommendation
- Upgrade to Revive Adserver 6.0.9 or later. The same release also fixes higher-rated issues (CVE-2026-107662, CVE-2026-107247).
- Review existing campaign-zone links for campaigns that belong to a different agency or manager.
- Limit admin access to trusted networks and remove unused manager or trafficker accounts.
- Check the vendor release notes for the upgrade path before updating.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-68486 www.cve.org
- HackerOne report 3958112 hackerone.com
- REVIVE-SA-2026-002 (related earlier advisory) www.revive-adserver.com
- VulDB 435889 vuldb.com
- OffSeq Radar CVE-2026-68486 radar.offseq.com
- Revive Adserver issues (security label) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:32.
Original description (NVD)
An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.