Manageengine Exchange Reporter Plus CVE-2026-27655

Authenticated user with login credentials to ManageEngine Exchange Reporter Plus versions before 5802. Attacker must inject malicious payload into the 'Permissions Based on Mailboxes' report. Victim must view the crafted report in their browser.

Real-world risk is moderate-to-high despite the 7.3 CVSS score. The CVSS vector reveals critical constraints: authentication required (PR:L) and mandatory user interaction (UI:R) significantly reduce attack surface compared to unauthenticated vulnerabilities. Attack vector is network-based (AV:N) with low complexity (AC:L), meaning exploitation is straightforward once access is obtained. The vulnerability enables high confidentiality and integrity impact (C:H/I:H) but no availability impact (A:N), indicating potential session hijacking, credential theft, or data manipulation. No EPSS score is available for correlation, and CISA KEV does not list this CVE, confirming no confirmed active exploitation. However, the authentication requirement creates a barrier: attackers need valid low-privilege credentials first, then must socially engineer an administrator to view the poisoned report. The stored nature makes this more dangerous than reflected XSS since the payload persists and can affect multiple victims over time. Given the enterprise deployment context of Exchange Reporter Plus and the potential for compromising Exchange administrators, organizations using affected versions should prioritize remediation despite the lack of public exploits. The SSVC framework would likely classify this as 'Attend' priority-patch in normal cycle but monitor for exploitation signals.

An attacker with valid low-privilege credentials to ManageEngine Exchange Reporter Plus crafts a malicious mailbox permission entry or report parameter containing embedded JavaScript payload and submits it through the Permissions Based on Mailboxes reporting interface. The application fails to sanitize this input, storing the malicious script in the backend database or report cache. When an Exchange administrator subsequently accesses this report to review mailbox permissions-a routine administrative task-the stored JavaScript executes in their browser session with the administrator's privileges. The payload exfiltrates the administrator's session token to an attacker-controlled server, enabling session hijacking and full administrative access to Exchange Reporter Plus and potentially connected Exchange infrastructure. The attacker can then access sensitive email metadata, compliance reports, and audit logs, or inject additional persistent backdoors into other reporting modules. No public exploit identified at time of analysis, but the low attack complexity (AC:L) suggests proof-of-concept development would be straightforward for attackers familiar with stored XSS techniques.