How to fix CVE-2026-28754?

Within 24 hours: Identify all ManageEngine Exchange Reporter Plus installations and document current versions. Within 7 days: Upgrade all instances to version 5802 or later, or implement access controls restricting report creation to trusted administrators only. Within 30 days: Audit recent Distribution Lists reports for anomalous content; conduct credential rotation for administrative accounts that have viewed reports since deployment; implement Web Application Firewall (WAF) rules to detect XSS patterns in report parameters.

Is Microsoft affected by CVE-2026-28754?

ManageEngine Exchange Reporter Plus versions before 5802 contain a stored XSS vulnerability that allows low-privileged authenticated users to inject malicious scripts into reports, potentially exposing administrator credentials and session tokens when other users view the compromised reports.

CVE-2026-28754

EUVD-2026-18615 HIGH

2026-04-03 Zohocorp

7.3

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 03, 2026 - 10:30 euvd

EUVD-2026-18615

Analysis Generated

Apr 03, 2026 - 10:30 vuln.today

CVE Published

Apr 03, 2026 - 10:08 nvd

HIGH 7.3

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.

Analysis

Stored cross-site scripting (XSS) in ManageEngine Exchange Reporter Plus versions prior to 5802 allows authenticated attackers with low privileges to inject malicious scripts into Distribution Lists reports that execute when viewed by other users, potentially compromising session tokens and account credentials of administrators or other privileged users. The vulnerability requires user interaction (victim must view the malicious report) but enables high-impact attacks against confidentiality and integrity within the application scope. …

Remediation

Within 24 hours: Identify all ManageEngine Exchange Reporter Plus installations and document current versions. Within 7 days: Upgrade all instances to version 5802 or later, or implement access controls restricting report creation to trusted administrators only. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +36

POC: 0

CVE-2026-28754 vulnerability details – vuln.today

Back

CVE-2026-28754

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-28754

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code