CVE-2026-28703 Zohocorp CVE debrief

Who should care

Users of ManageEngine Exchange Reporter Plus versions before 5802 should apply the patch to prevent exploitation. Security teams and administrators responsible for managing Exchange Reporter Plus instances should review their inventory and prioritize patching. Vulnerability management and security teams should monitor for suspicious activity in Mails Exchanged Between Users report.

Technical summary

The vulnerability is a Stored XSS in the Mails Exchanged Between Users report of ManageEngine Exchange Reporter Plus versions before 5802. The CVSS score is 7.3, indicating a high severity. This issue allows attackers to inject malicious scripts into the report, potentially leading to user interaction and exploitation.

Defensive priority

High priority due to high CVSS score and potential for user interaction.

Recommended defensive actions

• Apply the patch to upgrade to version 5802 or later
• Review and update inventory of ManageEngine Exchange Reporter Plus instances
• Monitor for suspicious activity in Mails Exchanged Between Users report
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from NVD and CVE.org confirms the vulnerability exists in versions before 5802. The vulnerability is a Stored XSS in the Mails Exchanged Between Users report of ManageEngine Exchange Reporter Plus. This issue has a high CVSS score of 7.3, indicating high severity. Users should verify their deployments and apply patches or mitigations as recommended by the vendor.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.