What is the CVSS score of CVE-2026-3879?

CVE-2026-3879 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Zoho are affected by CVE-2026-3879?

ManageEngine Exchange Reporter Plus contains a stored cross-site scripting vulnerability that allows low-privileged authenticated users to inject malicious scripts into reports, potentially…. A patch is available.

How to fix or mitigate CVE-2026-3879?

Within 24 hours: Identify all ManageEngine Exchange Reporter Plus instances and document current versions in your environment. Within 7 days: Upgrade all instances to version 5802 or later per vendor patch availability. Within 30 days: Audit report access logs for suspicious activity, review user privilege assignments to minimize low-privileged report creation access, and implement network segmentation to restrict administrative access to reporting interfaces.

Zoho CVE-2026-3879

EUVD-2026-18621 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-03 Zohocorp

GHSA-c53v-pgpj-xcg4

XSS Microsoft Zoho Manageengine Exchange Reporter Plus

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 24, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Jul 24, 2026 - 21:22 NVD

7.3 (HIGH) 4.8 (MEDIUM)

Analysis Updated

Apr 16, 2026 - 06:07 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5802

EUVD ID Assigned

Apr 03, 2026 - 12:00 euvd

EUVD-2026-18621

Analysis Generated

Apr 03, 2026 - 12:00 vuln.today

CVE Published

Apr 03, 2026 - 11:33 nvd

HIGH 7.3

DescriptionNVD

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.

AnalysisAI

Stored cross-site scripting in ManageEngine Exchange Reporter Plus (versions prior to 5802) allows authenticated attackers with low privileges to inject malicious scripts into Equipment Mailbox Details reports, enabling session hijacking and credential theft against administrative users who view the poisoned reports. No active exploitation confirmed (not in CISA KEV), but the vulnerability affects organizations monitoring Microsoft Exchange environments through ManageEngine's reporting platform.

Technical ContextAI

ManageEngine Exchange Reporter Plus is a web-based reporting and auditing solution for Microsoft Exchange Server environments, tracking mailbox usage, email traffic, and resource allocation. This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS condition where user-supplied input in Equipment Mailbox Details reports is not properly sanitized before being rendered in administrators' browsers. Equipment Mailboxes in Exchange are resource accounts representing schedulable assets like conference rooms or vehicles. The affected product is identified by CPE cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:* covering all versions before build 5802. The stored nature of this XSS makes it particularly dangerous as the malicious payload persists in the database and executes whenever privileged users access the affected report, unlike reflected XSS which requires per-victim social engineering.

RemediationAI

Organizations should immediately upgrade ManageEngine Exchange Reporter Plus to version 5802 or later, which contains vendor-supplied fixes addressing the stored XSS vulnerability in Equipment Mailbox Details reports. The official vendor security advisory at https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-3879.html provides detailed upgrade instructions and release notes. Prior to patching, implement compensating controls including restricting access to report creation and modification functions to trusted administrators only, reviewing existing Equipment Mailbox reports for suspicious content or script tags, monitoring authentication logs for unauthorized access to low-privilege accounts that could inject payloads, and educating report consumers about XSS risks and unusual browser behavior when accessing reports. Apply web application firewall rules to detect and block common XSS patterns if WAF infrastructure fronts the ManageEngine instance. Post-upgrade, validate the fix by testing Equipment Mailbox Detail report functionality and reviewing audit logs for any anomalous activity during the vulnerable period.