Strix
75.6K

CVE-2026-108563

MEDIUMCVSS 4.7/10EPSS 0.34%

Last modified

CVE-2026-108563 is a medium-severity vulnerability rated 4.7/10 on the CVSS scale. Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet application, attacker-supplied formulas can be evaluated. EPSS estimates a 0.34% chance of exploitation in the next 30 days.

Description

Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet application, attacker-supplied formulas can be evaluated. The confirmed impact is formula execution within the workbook; disclosure of information to the attacker has not been established. The issue is fixed in Revive Adserver 6.0.9 by sanitising conversion values before writing them to the affected XLS report sections.

Metrics

CVSS 3.0
4.7/10

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

EPSS Probability
0.34%

28.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
ReviveAdserver<= 6.0.8

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2026-108563?
Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet application, attacker-supplied formulas can be evaluated. The confirmed impact is formula execution within the workbook; disclosure of information to the attacker has not been established. The issue is fixed in Revive Adserver 6.0.9 by sanitising conversion values before writing them to the affected XLS report sections.
How severe is CVE-2026-108563?
CVE-2026-108563 has a CVSS score of 4.7/10 (MEDIUM severity). The EPSS model estimates a 0.34% probability of exploitation in the next 30 days.
How do I fix CVE-2026-108563?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-108563?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST