What is CVE-2026-34916?

CVE-2026-34916 is a high-severity vulnerability in Revive Adserver, classified under Code Injection. CVSS score: 8.8/10. Published 2026-06-23.

How severe is CVE-2026-34916?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Revive Adserver

CVE-2026-34916

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.006 (49.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Revive Adserver — versions 0

Weakness classification (CWE)

CWE-94 — Code Injection

References

support@hackerone.com

Frequently asked questions

What is CVE-2026-34916?: CVE-2026-34916 is a high-severity vulnerability in Revive Adserver, classified under Code Injection. CVSS score: 8.8/10. Published 2026-06-23.
How severe is CVE-2026-34916?: High severity. CVSS v3 base score is 8.8 out of 10.