Manageengine Exchange Reporter Plus EUVD-2026-18627

Requires authenticated user access to ManageEngine Exchange Reporter Plus versions before 5802. Attacker must have privileges to create or modify Non-Owner Mailbox Permission reports. Victim must view the malicious report to trigger stored XSS payload execution.

Real-world risk is moderate-to-high but constrained by authentication and interaction requirements. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) indicates network-accessible exploitation with low complexity, requiring low-privileged authentication and user interaction, with high confidentiality and integrity impact but no availability impact. The PR:L requirement means attackers need valid credentials to the Exchange Reporter Plus interface, limiting opportunistic exploitation but not insider threats or compromised accounts. The UI:R component necessitates a victim user (likely administrators or auditors) viewing the poisoned report, reducing automated exploitation potential. No CISA KEV listing and absence of public exploit code suggest this is not yet actively exploited in the wild, but the straightforward nature of stored XSS (AC:L) means proof-of-concept development is trivial for skilled attackers. Organizations using Exchange Reporter Plus should prioritize patching given the product's typical deployment context with privileged access to Exchange infrastructure, where session hijacking could enable lateral movement or data exfiltration from mailbox audit trails.

An authenticated attacker with low-privileged access to ManageEngine Exchange Reporter Plus crafts a malicious Non-Owner Mailbox Permission report by injecting JavaScript payloads into report parameters or mailbox delegation data fields that the application fails to sanitize. When a system administrator or compliance auditor subsequently accesses this report through the web interface, the stored script executes in their browser context with their session privileges. The attacker's payload captures session cookies or authentication tokens, exfiltrates them to an external server, and uses the stolen credentials to access sensitive Exchange mailbox audit data, modify report configurations, or pivot to other administrative functions. Given the low attack complexity (AC:L) and the typical deployment of this product in privileged Exchange management scenarios, successful exploitation could enable unauthorized access to confidential email metadata, delegation relationships, and compliance audit trails without triggering multi-factor authentication challenges.