CVE-2026-27655
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A Stored XSS vulnerability in the 'Permissions Based on Mailboxes' report of ManageEngine Exchange Reporter Plus before version 5802 allows an attacker to inject a malicious script that is permanently stored on the server.
Risk Assessment
An attacker can exploit this vulnerability to steal administrator sessions, display fraudulent content, or perform other actions in the victim's browser context, potentially leading to data confidentiality and integrity breaches.
Recommendation
Immediately update ManageEngine Exchange Reporter Plus to version 5802 or later, which includes a fix for this vulnerability.
Other vulnerabilities in ManageEngine Exchange Reporter Plus
See all- CVE-2026-4108High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
- CVE-2026-4107High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to stored XSS in the Folder Message Count and Size report. An attacker can inject malicious scripts that execute in other users' browsers.
- CVE-2026-3880High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
- CVE-2026-3879High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in the 'Equipment Mailbox Details' report.
- CVE-2026-28703High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
- CVE-2026-28756High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
- CVE-2026-28754High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.
- CVE-2025-5347Medium
Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module. The vulnerability allows injection of malicious script that is stored and executed in the user's browser.
- CVE-2025-5343Medium
Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option. The vulnerability allows storage of malicious script that is executed in the user's browser.
- CVE-2025-5342Medium
Zohocorp ManageEngine Exchange Reporter Plus through 5721 is vulnerable to ReDoS in the search module.
Original NVD description (English source)
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS