What is the CVSS score of CVE-2026-28756?

CVE-2026-28756 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Zoho are affected by CVE-2026-28756?

ManageEngine Exchange Reporter Plus versions prior to 5802 contain a stored cross-site scripting vulnerability that allows low-privileged authenticated users to inject malicious scripts into reports…. A patch is available.

How to fix or mitigate CVE-2026-28756?

Within 24 hours: Inventory all ManageEngine Exchange Reporter Plus installations and document current versions. Within 7 days: Upgrade all instances to version 5802 or later per vendor advisory. Within 30 days: Conduct audit of report access logs for any unauthorized script injection attempts and review administrator session activity during the pre-patch period.

Zoho CVE-2026-28756

EUVD-2026-18619 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-03 Zohocorp

GHSA-4g8c-fcmg-72qf

XSS Microsoft Zoho Manageengine Exchange Reporter Plus Zohocorp

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 24, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Jul 24, 2026 - 21:22 NVD

7.3 (HIGH) 4.8 (MEDIUM)

Analysis Updated

Apr 16, 2026 - 06:07 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5802

EUVD ID Assigned

Apr 03, 2026 - 11:15 euvd

EUVD-2026-18619

Analysis Generated

Apr 03, 2026 - 11:15 vuln.today

CVE Published

Apr 03, 2026 - 11:11 nvd

HIGH 7.3

DescriptionNVD

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.

AnalysisAI

Stored cross-site scripting (XSS) in ManageEngine Exchange Reporter Plus before version 5802 allows authenticated attackers with low privileges to inject malicious scripts into the Permissions based on Distribution Groups report, potentially leading to session hijacking and account compromise of administrators viewing the report. No active exploitation confirmed (CISA KEV absent), but the network-accessible attack vector and low complexity make this exploitable with publicly documented vendor advisory details.

Technical ContextAI

This vulnerability affects Zohocorp ManageEngine Exchange Reporter Plus (CPE: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus), a web-based reporting solution for Microsoft Exchange environments. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as cross-site scripting. The stored XSS variant persists malicious JavaScript payloads in the application database, specifically within the Permissions based on Distribution Groups reporting module. When administrators or privileged users access the compromised report, the injected script executes in their browser context with their session privileges. This represents a failure to sanitize user-controlled input before rendering it in HTML responses, a critical security control for web applications handling Exchange server data visualization.

RemediationAI

Upgrade ManageEngine Exchange Reporter Plus to version 5802 or later, which contains vendor-released patches addressing the stored XSS vulnerability. Download the patched release from Zohocorp's official distribution channels and follow standard upgrade procedures documented in the ManageEngine deployment guide. Review the vendor advisory at https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-28756.html for version-specific installation notes. Post-upgrade, audit existing Distribution Groups reports for suspicious content or JavaScript payloads that may have been injected prior to patching. As a temporary risk reduction measure until patching, restrict access to the Permissions based on Distribution Groups reporting feature to only essential personnel and implement enhanced monitoring of user sessions accessing this module.