PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28756 Zohocorp CVE debrief

CVE-2026-28756 is a Stored XSS vulnerability in the Permissions based on Distribution Groups report of Zohocorp ManageEngine Exchange Reporter Plus versions before 5802. The vulnerability has a CVSS score of 7.3 and is classified as HIGH severity. It allows an attacker to inject malicious scripts, potentially leading to unauthorized actions or data breaches. Administrators and users should be aware of this vulnerability and take necessary actions to mitigate it.

Vendor
Zohocorp
Product
ManageEngine Exchange Reporter Plus
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Administrators and users of Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 should be aware of this Stored XSS vulnerability and take necessary actions to mitigate it. This includes reviewing and restricting user permissions, monitoring for suspicious activity, and updating to version 5802 or later.

Technical summary

The vulnerability exists in the Permissions based on Distribution Groups report of Zohocorp ManageEngine Exchange Reporter Plus versions before 5802. It allows an attacker to inject malicious scripts, potentially leading to unauthorized actions or data breaches. The vulnerability has a CVSS score of 7.3 and is classified as HIGH severity.

Defensive priority

High priority should be given to updating Zohocorp ManageEngine Exchange Reporter Plus to version 5802 or later to mitigate this vulnerability. Additionally, review and restrict user permissions, monitor for suspicious activity, and review compensating controls.

Recommended defensive actions

  • Update Zohocorp ManageEngine Exchange Reporter Plus to version 5802 or later
  • Review and restrict user permissions to minimize potential impact
  • Monitor for suspicious activity in the Permissions based on Distribution Groups report
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-04-03T11:17:05.767Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability affects Zohocorp ManageEngine Exchange Reporter Plus versions before 5802. Evidence is limited to public CVE and NVD information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-28756 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-28756

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-28756 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-28756

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-28756.html

    0fc0942c-577d-436f-ae8e-945763c79b02 - Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.