A bypass exists that defeats the previous remediation for CVE-2026-34916 in Revive Adserver. By supplying a disallowed but otherwise syntactically correct plugin identifier as the `type` field, or by invoking the `ox.setChannelTargeting` XML-RPC method, an attacker can activate a plugin that the system should reject. The flaw aligns with CWE‑94, which concerns code injection or execution via untrusted inputs. Because the bypass allows code to be executed in the adserver’s context, it can lead to full compromise of the underlying host.

Any Revive Adserver installation that has not applied the patch for CVE-2026-34916 is potentially vulnerable. No specific product versions are listed; therefore all releases—including the latest—should be checked for the applied fix.

The CVSS score of 8.8 indicates high severity, and the EPSS is not available, but the lack of a KEV listing does not reduce the threat. An attacker can exploit the issue remotely over the network by crafting a request that targets the plugin validation path or the XML‑RPC endpoint. Because the vulnerability is a bypass rather than a new flaw, it can be triggered from an external attacker’s interface with legitimate-looking payloads. If the application is exposed to the open internet, the likelihood of exploitation remains elevated.