CVE-2026-21640

HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://hackerone.com/reports/3445332	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:18

Type	Values Removed	Values Added
Summary		(es) El miembro de la comunidad de HackerOne Faraz Ahmed (PakCyberbot) ha informado de una inyección de cadena de formato en la configuración de Revive Adserver. Cuando se utilizan combinaciones de caracteres específicas en una configuración, la consola del usuario administrador podría deshabilitarse debido a un error fatal de PHP.

30 Jan 2026, 20:17

Type	Values Removed	Values Added
First Time		Aquaplatform Aquaplatform revive Adserver
References	~~() https://hackerone.com/reports/3445332 -~~	() https://hackerone.com/reports/3445332 - Third Party Advisory
CPE		cpe:2.3:a:aquaplatform:revive_adserver::::::::

21 Jan 2026, 19:16

Type	Values Removed	Values Added
CWE		CWE-134

20 Jan 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-20 21:16

Updated : 2026-06-17 10:18

NVD link : CVE-2026-21640

Mitre link : CVE-2026-21640

CVE.ORG link : CVE-2026-21640

JSON object : View

Products Affected

aquaplatform

revive_adserver

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2026-21640", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21640", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T18:32:40.483218Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Revive", "product": "Revive Adserver", "versions": [{"status": "affected", "version": "6", "versionType": "semver", "lessThanOrEqual": "6.0.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-20T21:16:06.063", "references": [{"url": "https://hackerone.com/reports/3445332", "tags": ["Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error."}, {"lang": "es", "value": "El miembro de la comunidad de HackerOne Faraz Ahmed (PakCyberbot) ha informado de una inyecci\u00f3n de cadena de formato en la configuraci\u00f3n de Revive Adserver. Cuando se utilizan combinaciones de caracteres espec\u00edficas en una configuraci\u00f3n, la consola del usuario administrador podr\u00eda deshabilitarse debido a un error fatal de PHP."}], "lastModified": "2026-06-17T10:18:51.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AA08D1C-3638-4E0D-AC58-A8527E77536F", "versionEndIncluding": "6.0.4", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}