CVE-2026-21664 Cross-site scripting in Revive Adserver

Medium 6.1 Published 20 Jan 2026 Updated 21 Jan 2026

Reflected XSS in Revive Adserver allows attackers to execute malicious scripts in an administrator's browser via a crafted URL.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-21664?

CVE-2026-21664 is a medium-severity cross-site scripting vulnerability in Revive Adserver, published on 20 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

Weakness: CWE-79

Which versions are affected by CVE-2026-21664?

It affects 1 product.

Products include Aquaplatform Revive Adserver.

How do I fix CVE-2026-21664?

No fix has been published for CVE-2026-21664 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-21664 being exploited?

There is no known exploitation of CVE-2026-21664 in the wild and no public exploit code.

Sources

Also known as GHSA-982f-qxrw-6prp.