Stored XSS in ManageEngine Exchange Reporter Plus Distribution Lists

Impact Analysis

Exploitation of this vulnerability can enable an attacker to perform unauthorized actions within Exchange Reporter Plus by executing malicious scripts in the context of any user who views the infected Distribution Lists report.

Since the attacker needs Exchange administrative privileges to inject the script, the impact includes potential misuse of high-level privileges and compromise of sensitive Exchange data or configurations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-28754 is a stored Cross-Site Scripting (XSS) vulnerability found in the Distribution Lists report of ManageEngine Exchange Reporter Plus versions 5801 and below.

This vulnerability allows an authenticated attacker with Exchange administrative privileges to inject malicious scripts that get stored and executed when other users view the compromised report.

The issue arises from improper input validation, which was fixed in build 5802 by preventing script injection.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the Distribution Lists report of Exchange Reporter Plus versions 5801 and below. Detection involves identifying if your Exchange Reporter Plus instance is running a vulnerable build.

There are no specific commands provided to detect exploitation or presence of the vulnerability on your network or system.

To check the version of Exchange Reporter Plus installed, you may need to access the application interface or check the installation details, but no explicit command-line instructions are given.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update Exchange Reporter Plus to build 5802 or later, where the issue has been fixed by implementing proper input validation to prevent script injection.

Users should apply the service pack update released on March 19, 2026.

For assistance with updating or further inquiries, contacting product support or the security team is recommended.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a stored Cross-Site Scripting (XSS) flaw in the Distribution Lists report of Exchange Reporter Plus, which could allow an attacker to perform unauthorized actions by injecting malicious scripts.

Such unauthorized actions and potential data manipulation or exposure could impact the integrity and confidentiality of data handled by the system, which are critical aspects of compliance with standards like GDPR and HIPAA.

However, the provided information does not explicitly detail the direct effects on compliance with these regulations.

Useful 0 Not Useful 0