Microsoft EUVD-2026-18627

Upgrade ManageEngine Exchange Reporter Plus to build 5802 or later, which contains fixes for the stored XSS vulnerability per the vendor security advisory at https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-4108.html. Administrator should download the latest version from the ManageEngine product portal and follow standard upgrade procedures, ensuring backups of configuration and report data before applying the patch. As an interim control while scheduling upgrades, restrict access to the Exchange Reporter Plus web interface to trusted administrator IP ranges using firewall rules or web application firewall policies, and educate users with report access about the risks of clicking unexpected links or interacting with anomalous report content. Review audit logs for suspicious report modifications or unusual authentication patterns that might indicate reconnaissance or exploitation attempts. No workarounds exist to fully mitigate stored XSS without patching, as the vulnerability resides in the core report rendering logic.