Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in…

CVE-2026-28754 is a stored XSS flaw in the Distribution Lists report of ManageEngine Exchange Reporter Plus, affecting build 5801 and below and fixed in build 5802. The vulnerable path is not generic unauthenticated web input; the vendor says an attacker must be authenticated and have Exchange administrative privileges within the Exchange organization to inject script that later executes when another user opens the affected report.

The vendor's HIGH 7.3 score is too hot for how this lands in enterprise reality. The decisive friction is the attacker prerequisite: needing Exchange admin already means this is mostly a post-initial-access / post-privilege-escalation move, and exploitation still depends on a second user viewing one specific report in a browser; that makes the reachable population and operational blast radius much narrower than the CNA vector suggests.

Why this verdict

• Start from vendor 7.3, then cut hard for attacker position: the advisory requires authenticated Exchange administrative privileges, which implies prior compromise or insider access rather than internet-origin initial exploitation.
• Cut again for trigger friction: this is stored XSS with UI:R in one named report, so the attacker still needs a privileged victim to open Distribution Lists before anything happens.
• Cut again for blast radius: successful execution acts in the victim's Exchange Reporter Plus browser context; this is harmful, but it is not server-side RCE or domain-wide unauthenticated takeover.

Why not higher?

It is not higher because the chain stacks multiple gating conditions: authenticated access, Exchange admin privileges, and victim interaction on a specific report. Each prerequisite narrows both the reachable population and the value of the bug as a standalone entry vector.

Why not lower?

It is not lower because stored XSS in an admin console can still steal sessions or drive privileged actions if the right operator opens the page. In organizations that expose ManageEngine admin tooling too broadly or share admin workstations, this can still become an effective lateral move.

1. Restrict console reachability — Put Exchange Reporter Plus behind VPN, admin subnet ACLs, or an internal reverse proxy and remove broad user reachability. For a LOW verdict there is no formal mitigation SLA, so do this in the next normal change window if the console is more exposed than it should be.
2. Tighten admin access — Reduce the number of users who can both administer Exchange objects and view Exchange Reporter Plus reports; enforce MFA and privileged access management for those roles. This shrinks the overlap needed for the attack chain and should be folded into routine hardening rather than emergency response.
3. Audit distribution-list metadata — Review distribution-list names, aliases, descriptions, and any report-rendered fields for suspicious HTML or script-like content, especially where admin changes occurred near 2026-03-19 to 2026-04-03. This is the fastest way to remove a seeded payload if you cannot patch immediately.
4. Monitor report access and session anomalies — Log and review access to the Distribution Lists report and correlate with odd follow-on admin actions, token reuse, or browser-origin requests. That gives you a compensating detective control while the issue rides through normal remediation.

Run this on the target Windows host where ManageEngine Exchange Reporter Plus is installed. Invoke it as powershell.exe -ExecutionPolicy Bypass -File .\check-cve-2026-28754.ps1; local admin is preferred for reliable registry and service-path access, though read access is often enough.

# check-cve-2026-28754.ps1

# Verifies whether ManageEngine Exchange Reporter Plus is below build 5802.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


param(
    [int]$FixedBuild = 5802
)

$ErrorActionPreference = 'SilentlyContinue'

function Get-BuildFromString {
    param([string]$Text)
    if ([string]::IsNullOrWhiteSpace($Text)) { return $null }

    # Prefer the last 4-5 digit token, which commonly represents a build number.

    $matches = [regex]::Matches($Text, '(\d{4,5})')
    if ($matches.Count -gt 0) {
        return [int]$matches[$matches.Count - 1].Value
    }

    return $null
}

function Get-ProductCandidates {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $items = foreach ($path in $paths) {
        Get-ItemProperty -Path $path | Where-Object {
            $_.DisplayName -match 'ManageEngine.*Exchange Reporter Plus|Exchange Reporter Plus'
        }
    }

    return $items
}

function Test-InstalledBuild {
    $candidates = Get-ProductCandidates

    foreach ($item in $candidates) {
        $name = $item.DisplayName
        $displayVersion = $item.DisplayVersion
        $installLocation = $item.InstallLocation

        $build = Get-BuildFromString -Text $displayVersion
        if ($null -ne $build) {
            return [PSCustomObject]@{
                Source = 'UninstallRegistry'
                Name = $name
                VersionText = $displayVersion
                InstallLocation = $installLocation
                Build = $build
            }
        }
    }

    # Fallback: inspect likely service binary paths if version metadata exists.

    $svc = Get-CimInstance Win32_Service | Where-Object {
        $_.DisplayName -match 'Exchange Reporter Plus' -or $_.Name -match 'Exchange.*Reporter'
    } | Select-Object -First 1

    if ($svc -and $svc.PathName) {
        $rawPath = $svc.PathName.Trim('"')
        $exePath = ($rawPath -split '\s+')[0].Trim('"')
        if (Test-Path $exePath) {
            $fv = (Get-Item $exePath).VersionInfo.FileVersion
            $build = Get-BuildFromString -Text $fv
            if ($null -ne $build) {
                return [PSCustomObject]@{
                    Source = 'ServiceBinary'
                    Name = $svc.DisplayName
                    VersionText = $fv
                    InstallLocation = Split-Path -Parent $exePath
                    Build = $build
                }
            }
        }
    }

    return $null
}

$result = Test-InstalledBuild

if ($null -eq $result) {
    Write-Output 'UNKNOWN - Could not locate ManageEngine Exchange Reporter Plus build information on this host.'
    exit 2
}

if ($result.Build -lt $FixedBuild) {
    Write-Output ("VULNERABLE - {0} appears to be build {1} (source: {2}; version text: {3})" -f $result.Name, $result.Build, $result.Source, $result.VersionText)
    exit 1
}
else {
    Write-Output ("PATCHED - {0} appears to be build {1} (source: {2}; version text: {3})" -f $result.Name, $result.Build, $result.Source, $result.VersionText)
    exit 0
}

Sources

1. ManageEngine advisory for CVE-2026-28754
2. ManageEngine build 5802 release announcement
3. NVD entry for CVE-2026-28754
4. CISA Known Exploited Vulnerabilities Catalog
5. Tenable Nessus plugin 305773
6. Shodan CVE dashboard for ManageEngine Exchange Reporter Plus
7. Tenable CVE page with EPSS and NVD-aligned scoring