CVE-2026-50740 is a reflected XSS vulnerability in Revive Adserver affecting version 6.0.7 and earlier. The issue arises from insufficient sanitization of the refresh parameter in the zone-include.php script, which can be manipulated by a low-privileged user to inject malicious scripts. This vulnerability could lead to partial confidentiality and integrity impacts via reflected XSS. The CVSS 3.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts with no availability impact. No known exploits in the wild or vendor patches have been reported as of the published date.

Successful exploitation allows an attacker with low privileges to execute reflected cross-site scripting attacks, potentially leading to partial compromise of confidentiality and integrity of user sessions or data in the affected application context. There is no reported impact on availability. The attack requires user interaction and is exploitable remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable script or applying custom input sanitization controls if feasible. Monitor vendor channels for updates and patches addressing this vulnerability.