Manageengine Exchange Reporter Plus CVE-2026-4107

Authenticated user with login access to ManageEngine Exchange Reporter Plus versions before 5802. Attacker injects malicious payload into Folder Message Count and Size report. Victim must view the crafted report in the web interface.

Real-world risk is moderate despite the CVSS 7.3 High rating. The CVSS vector reveals important limiting factors: PR:L requires authenticated access (low-privilege user account needed) and UI:R mandates user interaction (victim must view the malicious report). Attack vector AV:N confirms network accessibility, and AC:L indicates low attack complexity once authenticated. The high confidentiality and integrity impact (C:H/I:H) reflects potential session hijacking, credential theft, or administrative action execution if administrators view the poisoned report. However, no confirmed actively exploited status exists (not in CISA KEV), and no public exploit code is identified at time of analysis. The SSVC framework would classify this as requiring user interaction (not automatable), with technical impact of partial system compromise limited to web application context. Priority depends heavily on deployment context: organizations using this product for Exchange monitoring should patch promptly as administrative users regularly access reports, creating realistic exploitation opportunities. The requirement for prior authentication and social engineering (convincing admins to view reports) reduces urgency compared to unauthenticated remote code execution vulnerabilities.

An attacker with low-privilege authenticated access to ManageEngine Exchange Reporter Plus crafts a malicious Folder Message Count and Size report by injecting JavaScript payloads into input fields such as custom folder names or report parameters that are not properly sanitized. When a privileged administrator or fellow user subsequently views this stored report through the web interface, the malicious script executes in their browser context, enabling the attacker to steal session cookies, capture administrative credentials, or perform unauthorized actions with the victim's privileges such as modifying Exchange monitoring configurations or exfiltrating sensitive email metadata. Given the low attack complexity (AC:L) and network accessibility (AV:N), attackers who have obtained initial low-privilege credentials through phishing or credential stuffing could reliably weaponize this vulnerability against organizations relying on this Exchange reporting platform.