CVE-2026-4107
Published: 03 April 2026
Summary
CVE-2026-4107 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Zohocorp Manageengine Exchange Reporter Plus. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 6.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates inputs to the Folder Message Count and Size report to prevent injection and storage of malicious scripts.
Filters output from the affected report to prevent execution of stored malicious scripts in viewers' browsers.
Requires timely application of vendor patches, such as upgrading to version 5802, to remediate the specific XSS flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables injection of scripts that execute in admins' browsers upon viewing the report, directly facilitating browser session hijacking (T1185), stealing web session cookies (T1539), and capturing web portal credentials/input (T1056.003).
NVD Description
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.
Deeper analysisAI
CVE-2026-4107 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting Zohocorp ManageEngine Exchange Reporter Plus versions prior to 5802. The issue resides specifically in the Folder Message Count and Size report, where malicious scripts can be persistently stored. Published on 2026-04-03, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), reflecting high potential impacts on confidentiality and integrity over a network with low attack complexity.
An attacker with low privileges (PR:L), such as an authenticated user, can exploit this vulnerability remotely (AV:N) by injecting malicious payloads into the affected report. Exploitation requires user interaction (UI:R), typically when a higher-privileged administrator views the tampered report, triggering script execution in the victim's browser context within the unchanged security scope (S:U). Successful attacks enable high confidentiality breaches, such as session hijacking or data exfiltration, and integrity violations like unauthorized modifications.
The official ManageEngine advisory at https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-4107.html details mitigation, recommending an upgrade to version 5802 or later, which addresses the vulnerability.
Details
- CWE(s)