CVE-2026-28756
Published: 03 April 2026
Summary
CVE-2026-28756 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Zohocorp Manageengine Exchange Reporter Plus. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validating inputs to prevent storage of malicious scripts in the Permissions based on Distribution Groups report, directly mitigating the stored XSS vulnerability.
SI-15 mandates filtering information outputs to neutralize scripts when rendering the affected report, preventing execution in the viewer's context.
SI-2 ensures timely flaw remediation by applying the vendor patch to version 5802, eliminating the specific stored XSS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables arbitrary JavaScript execution in victim browsers (T1059.007), directly facilitating web session cookie theft (T1539) and browser session hijacking (T1185) to impersonate users or steal data as described in the CVE impact.
NVD Description
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
Deeper analysisAI
CVE-2026-28756 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting Zoho Corp's ManageEngine Exchange Reporter Plus in versions before 5802. The issue exists in the "Permissions based on Distribution Groups" report, where malicious scripts can be stored and executed in the context of viewing users.
Exploitation requires low privileges (PR:L) and occurs over the network (AV:N) with low attack complexity (AC:L), though it demands user interaction (UI:R) such as clicking or viewing the affected report. The CVSS v3.1 base score of 7.3 (High) reflects high impacts on confidentiality (C:H) and integrity (I:H) with no availability impact (A:N) and unchanged scope (S:U), allowing attackers to steal session data, impersonate users, or manipulate report content.
ManageEngine has issued an advisory detailing the vulnerability at https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-28756.html, recommending an upgrade to version 5802 or later to address the flaw.
Details
- CWE(s)