Manageengine Exchange Reporter Plus CVE-2026-28756

Requires authenticated user access to ManageEngine Exchange Reporter Plus versions before 5802. Attacker must have privileges to modify the Permissions based on Distribution Groups report. Victim must view the crafted report payload in their browser.

The CVSS score of 7.3 (HIGH) reflects a network-accessible attack requiring low privileges (PR:L) and user interaction (UI:R), with high impact to confidentiality and integrity but no availability impact. The attack complexity is low (AC:L), indicating exploitation requires minimal skill once authenticated access is obtained. While no EPSS score or KEV listing was provided in the intelligence, the requirement for user interaction (admin must view the poisoned report) reduces immediate automated exploitation risk. However, the stored nature of the XSS creates persistent risk - once injected, the payload affects all subsequent viewers until remediated. The Microsoft Exchange environment tag suggests deployment in enterprise contexts where compromise of admin sessions could enable lateral movement, email interception, or privilege escalation. Real-world priority is moderate-high: authenticated requirement lowers immediate risk, but stored XSS in admin-facing reporting tools represents a viable path for insider threats or compromised low-privilege accounts to escalate privileges.

An attacker with low-privileged authenticated access to ManageEngine Exchange Reporter Plus crafts a malicious Distribution Group name or permission field containing embedded JavaScript payload and saves it to the reporting database. When a system administrator subsequently opens the Permissions based on Distribution Groups report to review Exchange permissions, the stored script executes in their browser session with their administrative privileges. The attacker's payload could capture session cookies, perform unauthorized administrative actions on behalf of the victim (such as creating new accounts or modifying Exchange permissions), or redirect the administrator to a credential-harvesting phishing page - all while appearing to originate from the trusted ManageEngine interface.