Stored XSS Vulnerability in ManageEngine Exchange Reporter Plus by Zohocorp
CVE-2026-27655

7.3HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Exchange Reporter Plus
Vendor
CVE Published:
3 April 2026

What is CVE-2026-27655?

Zohocorp's ManageEngine Exchange Reporter Plus versions prior to 5802 are exposed to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw within the Permissions Based on Mailboxes report could allow attackers to execute arbitrary scripts in the context of the user's session, potentially compromising user data and application integrity. Organizations using affected versions should consider immediate updates to mitigate this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ManageEngine Exchange Reporter Plus 0 < 5802

References

https://www.manageengine.com/products/exchange-reports/ad...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.