CVE-2026-44959: Revive Adserver RCE Vulnerability

CVE-2026-44959 Overview

CVE-2026-44959 is a PHP code injection vulnerability in Revive Adserver version 6.0.6 and earlier. The flaw exists in the delivery limitations save logic, which fails to validate user-supplied parameters before persisting them. A low-privileged authenticated user can inject an unexpected component parameter containing malicious PHP into the compiledlimitations field. The stored payload executes during banner delivery, granting attackers code execution in the context of the ad server. The issue is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated low-privileged users can achieve remote PHP code execution on the Revive Adserver host, compromising confidentiality, integrity, and availability.

Affected Products

Revive Adserver 6.0.6
All Revive Adserver versions prior to 6.0.6
Deployments exposing the administrative banner delivery limitations interface

Discovery Timeline

2026-06-23 - CVE-2026-44959 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-44959

Vulnerability Analysis

The vulnerability resides in the workflow that saves delivery limitations for banners in Revive Adserver. Delivery limitations control when and where banners are served and are compiled into a serialized PHP expression stored in the compiledlimitations field. The application accepts component parameters from authenticated users without filtering unexpected keys. An attacker who can author or edit a banner can submit a crafted request containing an additional component parameter whose value contains PHP code.

When the ad server later renders the banner, it evaluates the compiledlimitations expression as part of the delivery decision. Because the attacker-controlled string is embedded directly into the evaluated code, the injected PHP runs with the privileges of the web server process.

Root Cause

The root cause is missing allow-list validation of component parameters submitted to the delivery limitations save handler. The handler trusts the parameter set provided by the client and concatenates unexpected fields into the compiled limitation logic. The compiled result is treated as executable PHP at delivery time, converting an input-validation gap into arbitrary code execution.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker logged in as any user permitted to manage banners and delivery limitations submits a modified HTTP request that includes a rogue component parameter. The malicious payload is persisted to the database and triggered whenever the affected banner is delivered. Successful exploitation yields server-side code execution, enabling data theft, lateral movement, and modification of ad-serving behavior.

The vendor remediated the issue by improving input sanitisation so that unexpected parameters are filtered before the compiled limitation expression is generated. See HackerOne Report #3744200 for the disclosure details.

Detection Methods for CVE-2026-44959

Indicators of Compromise

Entries in the acls or equivalent delivery limitations table where the compiledlimitations field contains PHP language constructs such as system(, passthru(, eval(, or backticks.
Web access logs showing POST requests to banner edit endpoints with parameter names outside the documented Revive component set.
Unexpected outbound network connections originating from the PHP-FPM or web server worker processes during banner delivery.

Detection Strategies

Audit the compiledlimitations column of stored banners for syntax that goes beyond boolean comparisons and Revive component identifiers.
Inspect HTTP request bodies submitted to the administrative interface for component parameter keys not present in the official Revive plugin schema.
Correlate banner save events with subsequent process executions or file writes on the ad server host to surface post-exploitation activity.

Monitoring Recommendations

Enable verbose application logging for banner edit and delivery limitation save operations, capturing the full submitted parameter list.
Forward web server, PHP error, and database logs to a centralized analytics platform for retroactive hunting once the vulnerability is patched.
Alert on PHP worker processes spawning shells, package managers, or network utilities, which are unusual during normal ad delivery.

How to Mitigate CVE-2026-44959

Immediate Actions Required

Upgrade Revive Adserver to a version newer than 6.0.6 that includes the improved input sanitisation for delivery limitations.
Restrict administrative and banner-management accounts to trusted operators and rotate credentials for any account that may have been misused.
Review existing banners and delivery limitation entries for malicious PHP payloads and remove any tampered records.

Patch Information

The vendor addressed CVE-2026-44959 by filtering unexpected component parameters during the delivery limitations save process, preventing arbitrary keys from reaching the compiled expression. Administrators should apply the fixed Revive Adserver release referenced in the HackerOne Report #3744200 advisory and verify the deployed version matches the patched build.

Workarounds

Place the Revive Adserver administrative interface behind a VPN or IP allow-list to limit who can submit banner edits until the patch is applied.
Temporarily revoke banner and delivery limitation editing permissions from non-essential users to shrink the attack surface.
Deploy a web application firewall rule that blocks banner save requests containing PHP tokens such as <?php, eval, or system in parameter values.

bash

# Example WAF rule (ModSecurity) to block PHP tokens in Revive banner save requests
SecRule REQUEST_URI "@contains /www/admin/banner-edit.php" \
  "phase:2,deny,status:403,id:1026044959,\
   chain,msg:'Possible CVE-2026-44959 exploit attempt'"
  SecRule ARGS "@rx (?i)(<\?php|eval\s*\(|system\s*\(|passthru\s*\(|`)" "t:none"