Manageengine Exchange Reporter Plus CVE-2026-3880

Requires authenticated user access to ManageEngine Exchange Reporter Plus versions before 5802. Attacker must inject malicious script into Public Folder Client Permissions report. Victim must view the crafted report in their browser. CVSS indicates low attack complexity, network accessible, requires low privileges and user interaction.

The CVSS vector reveals this requires low attack complexity (AC:L) and low-privileged authenticated access (PR:L) via network vector (AV:N), with user interaction required (UI:R). The high confidentiality and integrity impact (C:H/I:H) reflects the potential for session token theft and unauthorized actions performed in victim contexts. While the 7.3 CVSS score indicates high severity, real-world prioritization depends on deployment context: organizations with ManageEngine Exchange Reporter Plus exposed to untrusted authenticated users face elevated risk, whereas air-gapped or tightly controlled deployments have lower urgency. The stored nature increases impact compared to reflected XSS since a single injection affects multiple victims. No EPSS score, KEV listing, or public exploit code was provided in the intelligence data, suggesting this is a vendor-disclosed vulnerability without confirmed active exploitation. The authentication requirement and user interaction dependency reduce automated exploitation potential, but the stored persistence and high business impact on Exchange monitoring infrastructure warrant prompt patching in production environments.

An authenticated attacker with low-level privileges logs into ManageEngine Exchange Reporter Plus and navigates to the Public Folder Client Permissions report feature. By injecting malicious JavaScript payloads into report parameters or data fields that lack proper input sanitization, the attacker stores the script in the application database. When privileged administrators or other users subsequently access the compromised report to review Exchange public folder permissions, the stored malicious script executes in their browser contexts, allowing the attacker to steal session cookies, perform unauthorized configuration changes with the victim's privileges, or exfiltrate sensitive Exchange infrastructure data displayed in the reporting interface. The low attack complexity means exploitation requires only standard web application testing skills without specialized tools or timing dependencies.