CVE-2026-50742 is a stored XSS vulnerability in Revive Adserver 6.0.7 affecting the maintenance-acl-check.php and maintenance-banners-check.php tools. The issue is due to improper escaping of entity names displayed during inconsistency checks, allowing injection of malicious scripts. The attack vector requires network access with low privileges and user interaction by an administrator. The vulnerability impacts confidentiality and integrity with limited scope and complexity. No official patch or remediation level has been provided as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of an administrator's browser when they use the affected maintenance tools. This could lead to limited confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed with administrator privileges. Availability is not affected. The attacker has limited control over the timing of payload execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected maintenance tools to trusted administrators only and consider monitoring for suspicious activity related to these tools. Avoid using the affected maintenance tools if possible until a patch or official mitigation is released.