Manageengine Exchange Reporter Plus CVE-2026-28703

Requires authenticated user access to ManageEngine Exchange Reporter Plus versions before 5802. Attacker must inject malicious payload into the 'Mails Exchanged Between Users' report. Victim must view the crafted report in their browser to trigger XSS.

Real-world risk is moderate-to-high with several mitigating factors. The CVSS vector reveals network-based attack (AV:N) with low complexity (AC:L), but exploitation requires authenticated access (PR:L) and victim user interaction (UI:R), limiting the attack surface compared to unauthenticated vulnerabilities. The scope is unchanged (S:U), meaning compromise is contained within the vulnerable application context, though both confidentiality and integrity impacts are high (C:H/I:H), enabling session hijacking, credential theft, or administrative action on behalf of victims. No EPSS score provided, but the combination of required authentication and user interaction typically correlates with lower exploitation probability in automated scanning scenarios. CISA KEV status is not present, indicating no confirmed active exploitation. The absence of public proof-of-concept code further reduces immediate weaponization risk. However, the stored nature of the XSS (versus reflected) increases severity since payloads persist and can affect multiple users over time. Organizations using this product for Exchange email auditing should prioritize patching, particularly in environments where low-privilege users have report access or where the application is exposed to less-trusted internal networks.

An authenticated attacker with low-privilege access to ManageEngine Exchange Reporter Plus crafts a malicious email subject line or display name containing JavaScript payload, then generates or manipulates a 'Mails Exchanged Between Users' report to include this data. When administrators or auditors view the compromised report, the stored script executes in their browser context, potentially stealing session cookies, capturing credentials via fake login prompts, or performing administrative actions such as creating new accounts or modifying report configurations. The attack requires user interaction (viewing the report) but once deployed, the payload persists and affects multiple victims until the malicious data is purged.