Vulnerability · Published Jan 20, 2026 · Assigned by hackerone
CVE-2026-21640
Low 2.7
In plain English
A low-severity security flaw in Revive Adserver from Revive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.0)2.7Low
Exploit odds (30 days)0.3%top 83.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Revive | Revive Adserver | 6 – through 6.0.4 |
Weakness: CWE-134 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L