CVE-2026-28756: ManageEngine Exchange Reporter Plus XSS

CVE-2026-28756 Overview

CVE-2026-28756 is a stored cross-site scripting (XSS) vulnerability in Zohocorp ManageEngine Exchange Reporter Plus. The flaw affects all builds before 5802 and resides in the Permissions based on Distribution Groups report. An authenticated attacker with high privileges can inject persistent script payloads that execute in the browsers of report viewers. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Successful exploitation enables session compromise, administrative action hijacking, and credential theft within the Exchange Reporter Plus console through stored script execution.

Affected Products

• Zohocorp ManageEngine Exchange Reporter Plus versions prior to build 5802
• Zohocorp ManageEngine Exchange Reporter Plus 5.8 build 5800
• Zohocorp ManageEngine Exchange Reporter Plus 5.8 build 5801

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-28756 published to NVD
• 2026-04-03 - Last updated in NVD database

Technical Details for CVE-2026-28756

Vulnerability Analysis

The vulnerability exists in the Permissions based on Distribution Groups report within ManageEngine Exchange Reporter Plus. The application fails to neutralize user-controllable input before storing it and rendering it back to report consumers. When a victim opens the affected report, the malicious payload executes in the context of the application origin.

Exploitation requires high privileges and user interaction, and the impact crosses a security scope boundary. An attacker who can inject content reachable by this report can pivot to compromise sessions of other administrators viewing the same data. Network-based attackers can deliver payloads remotely without local access.

Root Cause

The root cause is improper output encoding of data rendered in the Distribution Groups permissions report. Input ingested from Exchange directory objects or user-supplied report fields is stored without sanitization. The rendering layer then emits the data into HTML context without encoding, allowing <script> and event-handler payloads to execute.

Attack Vector

The attack vector is network-based through the Exchange Reporter Plus web interface. An authenticated attacker with administrative privileges injects script content into a field that feeds the Distribution Groups report. A second user with rights to view the report triggers the payload when the report renders. The stored nature of the flaw means the payload persists across sessions until the affected record is cleaned.

No public proof-of-concept code is available for CVE-2026-28756. Refer to the ManageEngine Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-28756

Indicators of Compromise

• Unexpected <script>, onerror, onload, or javascript: strings stored in distribution group attributes or report metadata.
• Anomalous outbound requests from administrator browsers to attacker-controlled domains shortly after opening Exchange Reporter Plus reports.
• New or modified administrator accounts created shortly after a privileged user accessed the Distribution Groups report.

Detection Strategies

• Inspect Exchange Reporter Plus database tables backing the Distribution Groups report for HTML or JavaScript syntax in stored fields.
• Review web server access logs for POST requests to report configuration endpoints containing encoded script payloads.
• Correlate browser-side Content Security Policy violation reports with Exchange Reporter Plus session activity.

Monitoring Recommendations

• Monitor administrative authentication events to Exchange Reporter Plus for unusual session reuse or geographic anomalies.
• Alert on report rendering activity followed by privilege changes within the application within short time windows.
• Track outbound connections from administrator workstations to untrusted hosts during Exchange Reporter Plus usage.

How to Mitigate CVE-2026-28756

Immediate Actions Required

• Upgrade Zohocorp ManageEngine Exchange Reporter Plus to build 5802 or later without delay.
• Audit stored distribution group attributes and report fields for injected HTML or script content and purge any malicious entries.
• Rotate administrative credentials and invalidate active sessions if exploitation is suspected.

Patch Information

Zohocorp has released a fixed build of ManageEngine Exchange Reporter Plus that addresses CVE-2026-28756. Apply build 5802 or later as documented in the ManageEngine Security Advisory. Verify the build number through the console after upgrade.

Workarounds

• Restrict access to the Permissions based on Distribution Groups report to a minimal set of trusted administrators until patching is complete.
• Enforce a strict Content Security Policy on the Exchange Reporter Plus web interface through an upstream reverse proxy.
• Require administrators to use isolated browser profiles when accessing the application to limit session token exposure.

# Verify installed Exchange Reporter Plus build after upgrade
grep -i "build" /opt/ManageEngine/ExchangeReporterPlus/conf/product.conf
# Expected output should reflect build 5802 or higher