CVE-2026-28756 Zohocorp CVE debrief

Who should care

Administrators and users of Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 should be aware of this Stored XSS vulnerability and take necessary actions to mitigate it. This includes reviewing and restricting user permissions, monitoring for suspicious activity, and updating to version 5802 or later.

Technical summary

The vulnerability exists in the Permissions based on Distribution Groups report of Zohocorp ManageEngine Exchange Reporter Plus versions before 5802. It allows an attacker to inject malicious scripts, potentially leading to unauthorized actions or data breaches. The vulnerability has a CVSS score of 7.3 and is classified as HIGH severity.

Defensive priority

High priority should be given to updating Zohocorp ManageEngine Exchange Reporter Plus to version 5802 or later to mitigate this vulnerability. Additionally, review and restrict user permissions, monitor for suspicious activity, and review compensating controls.

Recommended defensive actions

• Update Zohocorp ManageEngine Exchange Reporter Plus to version 5802 or later
• Review and restrict user permissions to minimize potential impact
• Monitor for suspicious activity in the Permissions based on Distribution Groups report
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-04-03T11:17:05.767Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability affects Zohocorp ManageEngine Exchange Reporter Plus versions before 5802. Evidence is limited to public CVE and NVD information.

Official resources