Manageengine Exchange Reporter Plus CVE-2026-28754

ManageEngine Exchange Reporter Plus versions before 5802. Attacker requires authenticated user access (PR:L). Victim must view the Distribution Lists report containing injected payload (UI:R). Stored XSS executes in victim's browser session.

This vulnerability presents moderate real-world risk requiring careful contextual evaluation. The CVSS v3.1 score of 7.3 (High severity) reflects network-based attack vector (AV:N), low attack complexity (AC:L), but requires low privileges (PR:L) and user interaction (UI:R). The scope is unchanged (S:U), with high confidentiality and integrity impact but no availability impact. EPSS data is not available for this CVE. CISA KEV status is not present, indicating no confirmed active exploitation in the wild. No public proof-of-concept exploit code has been identified. From an SSVC decision framework perspective: exploitation status is none (no public POC or active use), automatability is no (requires authenticated access and social engineering for victim interaction), and technical impact is partial (limited to application scope, not system-level compromise). The requirement for authenticated access (PR:L) significantly reduces the attack surface compared to unauthenticated vulnerabilities, as attackers must first obtain valid credentials. However, in enterprise environments where ManageEngine products manage critical Exchange infrastructure, authenticated insider threats or compromised low-privilege accounts could exploit this to pivot to higher-privilege accounts. The stored nature means a single successful injection can compromise multiple victims over time. Priority should be moderate: patch during regular maintenance cycles for most organizations, but expedite for environments with limited internal access controls or where Exchange Reporter Plus is exposed to less-trusted user populations.

An attacker with authenticated low-privilege access to ManageEngine Exchange Reporter Plus (such as a junior IT staff member or a compromised service account) navigates to the Distribution Lists reporting module and crafts a malicious report entry containing JavaScript payload designed to steal session cookies or authentication tokens. This malicious script is stored in the application database as part of the report data. When a system administrator or security auditor later accesses the Distribution Lists report through normal workflow, the stored JavaScript executes in their browser context with their privilege level, exfiltrating session tokens to an attacker-controlled server. The attacker then uses the stolen administrative session to access sensitive Exchange audit data, modify reporting configurations, or pivot to other ManageEngine products in the environment. The attack complexity is low as it requires only basic XSS knowledge and authenticated access, though success depends on a privileged user subsequently viewing the poisoned report.