Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77168

Quick assessment

Affected
Revive Adserver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Revive Adserver 6.0.8 及更早版本中的 tracker-invocation.php 存在跨站请求伪造（CSRF）漏洞，攻击者可利用已认证受害者的权限，修改追踪器的名称、描述或广告主分配。该漏洞源于一个遗留的状态变更处理程序，该程序在接收请求参数时未验证 CSRF 令牌，尽管正常调用标签接口并不会使用此处理程序。利用该漏洞需要受害者交互，且请求路径需携带受害者的会话凭证。该问题已在 Revive Adserver 6.0.9 中通过移除未使用的追踪器修改处理程序得到修复。

AI Predicted 6.1 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Revive Adserver ≤ 6.0.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77168

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker's name, description or advertiser assignment using an authenticated victim's permissions. A leftover state-changing handler accepts request parameters without verifying a CSRF token, although it is not used by the normal invocation-tag interface. Exploitation requires victim interaction and a request path that carries the victim's session credentials. The issue is fixed in Revive Adserver 6.0.9 by removing the unused tracker-modification handler.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Revive Adserver 0 ~ 6.0.8 -

II. Public POCs for CVE-2026-77168

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77168

请登录查看更多情报信息。

Other References for CVE-2026-77168 (1)

Same Patch Batch · Revive · 2026-11-11 · 14 CVEs total

CVE-2026-108564 Revive Adserver 6.0.8 及之前版本反射型 XSS 漏洞
CVE-2026-108561 Revive Adserver 6.0.8 及之前版本存储型跨站脚本漏洞
CVE-2026-108558 Revive Adserver 6.0.8 及更早版本跨站脚本漏洞
CVE-2026-108559 Revive Adserver 6.0.8 及以下版本反射型 XSS 漏洞
CVE-2026-108565 Revive Adserver 6.0.8 及更早版本反射型跨站脚本漏洞
CVE-2026-108560 Revive Adserver 6.0.8 及更早版本反射型 XSS 漏洞
CVE-2026-108562 Revive Adserver 6.0.8 及之前版本存储型 XSS 漏洞
CVE-2026-108563 Revive Adserver 6.0.8 及以下版本电子表格公式注入漏洞
CVE-2026-107247 Revive 6.0.0-6.0.8 授权绕过漏洞
CVE-2026-107662 Revive Adserver 6.0.8 及更早版本盲 SQL 注入漏洞
CVE-2026-82978 Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68486 Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68485 Revive Adserver 6.0.8 及之前版本授权绕过漏洞

IV. Related Vulnerabilities

Same product: Adserver
Same vendor: Revive
Same weakness: CWE-352