CVE-2026-3879 Zohocorp CVE debrief

Who should care

Security teams and administrators responsible for Zohocorp ManageEngine Exchange Reporter Plus should prioritize patching to prevent potential XSS attacks. This includes reviewing and updating vulnerability management processes, monitoring systems for suspicious activity, and implementing additional security controls. Asset owners and operators of affected systems should also be aware of the potential risks and take necessary precautions.

Technical summary

The vulnerability is caused by improper input validation in the Equipment Mailbox Details report of Zohocorp ManageEngine Exchange Reporter Plus versions before 5802, allowing attackers to inject malicious scripts. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, indicating a HIGH severity vulnerability. This vulnerability could be exploited through malicious script injection, potentially leading to security breaches. The affected product, Zohocorp ManageEngine Exchange Reporter Plus, requires patching to version 5802 or later to mitigate this vulnerability.

Defensive priority

High priority should be given to patching Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 to prevent potential XSS attacks. This vulnerability has a HIGH severity CVSS score of 7.3, emphasizing the need for prompt action.

Recommended defensive actions

• Apply the patch provided by the vendor to update to version 5802 or later.
• Review and update vulnerability management processes to ensure timely patching of critical vulnerabilities.
• Monitor systems for potential suspicious activity related to this vulnerability.
• Implement additional security controls, such as input validation and output encoding, to prevent similar vulnerabilities.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record was published on 2026-04-03T12:16:18.743Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability exists in Zohocorp ManageEngine Exchange Reporter Plus versions before 5802, specifically in the Equipment Mailbox Details report. The CVSS score is 7.3, indicating a HIGH severity. The NVD provides additional details on the vulnerability, including its CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.