EUVD-2026-18623
GHSA-55qr-4rc4-w5vg
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
AnalysisAI
Stored cross-site scripting in ManageEngine Exchange Reporter Plus (versions prior to 5802) allows authenticated attackers to inject malicious scripts through the Public Folder Client Permissions report, enabling session hijacking and credential theft with medium exploitation complexity. No active exploitation confirmed (not present in CISA KEV), though the network-accessible attack vector and stored nature of the XSS elevate real-world risk for organizations using this Exchange monitoring solution.
Technical ContextAI
ManageEngine Exchange Reporter Plus is a reporting and monitoring solution for Microsoft Exchange environments. This vulnerability stems from improper neutralization of input during web page generation (CWE-79), specifically affecting the Public Folder Client Permissions report feature. The stored XSS variant persists malicious JavaScript in the application's data store, causing it to execute whenever other users view the affected report. The CPE identifier cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus confirms this affects Zohocorp's Exchange Reporter Plus product across all versions prior to the patched release. Unlike reflected XSS, stored XSS does not require social engineering for each exploitation instance once the payload is injected, as it automatically executes for subsequent users accessing the compromised report.
RemediationAI
Upgrade ManageEngine Exchange Reporter Plus to version 5802 or later, which contains vendor-released patches addressing the stored XSS vulnerability. Download the patched release from the official ManageEngine product portal and follow standard upgrade procedures per vendor documentation. Zohocorp's security advisory at https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-3880.html provides complete remediation guidance and release notes. If immediate patching is not feasible, implement defense-in-depth controls including restricting access to the Public Folder Client Permissions report to highly trusted administrators only, enforcing strict Content Security Policy headers, and monitoring for anomalous script injection attempts in report parameters. However, these workarounds do not eliminate the underlying vulnerability and should be considered temporary risk reduction measures pending full patch deployment.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today