Stored XSS in ManageEngine Exchange Reporter Plus Report

Executive Summary

CVE-2026-4107 is a high-severity stored Cross-Site Scripting (XSS) vulnerability found in Zoho ManageEngine Exchange Reporter Plus, specifically in the Folder Message Count and Size report within the Reports module.

This vulnerability affects versions with build numbers 5801 and below. An authenticated attacker who is a mailbox user within the Exchange organization can exploit this flaw to execute malicious scripts.

The issue arises because of improper input validation, allowing malicious script injection. It was fixed in build 5802 by implementing proper input validation.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation of this vulnerability may lead to unauthorized access to Exchange Reporter Plus by leveraging the privileges of the victim interacting with the compromised component.

This means an attacker could execute malicious scripts within the context of a legitimate user, potentially accessing sensitive information or performing unauthorized actions within the Exchange Reporter Plus environment.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-4107 vulnerability, users should update their Exchange Reporter Plus instances to build 5802 or later, as this update includes proper input validation to prevent malicious script injection.

If you need assistance with updating or have further inquiries, you should contact the product support or the security team.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the CVE-2026-4107 vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0