Stored XSS Vulnerability in ManageEngine Exchange Reporter Plus by Zohocorp
CVE-2026-4108

7.3HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Exchange Reporter Plus
Vendor
CVE Published:
3 April 2026

What is CVE-2026-4108?

ManageEngine Exchange Reporter Plus, developed by Zohocorp, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability that affects versions prior to 5802. This vulnerability occurs in the Non-Owner Mailbox Permission report, allowing malicious actors to inject scripts that can be executed by other users when they access the report. This could lead to unauthorized actions on behalf of users or compromise sensitive information.

Affected Version(s)

ManageEngine Exchange Reporter Plus 0 < 5802

References

https://www.manageengine.com/products/exchange-reports/ad...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.