Manageengine Exchange Reporter Plus CVE-2026-3879

Authenticated user with login credentials to ManageEngine Exchange Reporter Plus versions before 5802. Attacker must inject malicious payload into Equipment Mailbox Details report. Victim must view the crafted report in their browser. Requires low privilege access (PR:L) and user interaction.

The CVSS v3.1 score of 7.3 (High) reflects network-based exploitation (AV:N) with low attack complexity (AC:L), requiring low-level authentication (PR:L) and user interaction (UI:R), delivering high confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N). This translates to a realistic threat where authenticated insiders or compromised low-privilege accounts can plant persistent malicious scripts that execute in administrative contexts when reports are reviewed. The requirement for user interaction (administrators viewing the report) moderates immediate risk but does not eliminate it, as report review is a normal operational activity. No EPSS score provided, but the vulnerability is vendor-disclosed by Zohocorp themselves with a patch available, suggesting responsible disclosure rather than active exploitation. No CISA KEV listing indicates no confirmed widespread exploitation. The stored XSS variant elevates risk compared to reflected XSS since one successful injection compromises all subsequent viewers. Organizations using ManageEngine Exchange Reporter Plus in Microsoft Exchange environments face tangible risk of administrative session compromise, particularly in environments with shared reporting dashboards or automated report distribution.

An attacker with low-privilege authenticated access to ManageEngine Exchange Reporter Plus (such as a compromised help desk account or malicious insider) navigates to the Equipment Mailbox Details report creation interface and injects malicious JavaScript into a report field, such as mailbox name or description. The payload is stored in the application database. When an Exchange administrator subsequently views this report through the web interface to review conference room usage or equipment allocation, the malicious script executes in their browser context with their elevated session privileges. The script exfiltrates the administrator's session cookies to an attacker-controlled server, enabling session hijacking and full administrative access to Exchange reporting data, or modifies page content to harvest credentials through a fake re-authentication prompt. No public exploit code identified at time of analysis, but stored XSS exploitation techniques are well-documented and easily adaptable by moderately skilled attackers.