CVE-2026-4108
Published: 03 April 2026
Summary
CVE-2026-4108 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Zohocorp Manageengine Exchange Reporter Plus. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 6.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely application of vendor patches, such as upgrading to ManageEngine Exchange Reporter Plus version 5802, to remediate the specific stored XSS flaw in the Non-Owner Mailbox Permission report.
Mandates validation and sanitization of inputs to the Non-Owner Mailbox Permission report, preventing storage of malicious scripts that enable stored XSS.
Enforces output filtering and encoding when rendering the Non-Owner Mailbox Permission report, blocking execution of injected scripts in users' browsers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables browser script execution for stealing web session cookies (T1539) and hijacking sessions to impersonate users/steal data (T1185).
NVD Description
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
Deeper analysisAI
CVE-2026-4108 is a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting Zohocorp ManageEngine Exchange Reporter Plus versions before 5802. The flaw resides in the Non-Owner Mailbox Permission report, where malicious input can be persistently stored and executed in users' browsers. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), reflecting high potential impacts on confidentiality and integrity with no availability disruption.
Exploitation requires an attacker to possess low privileges (PR:L) and occurs over the network (AV:N) with low attack complexity (AC:L), though it demands user interaction (UI:R) such as viewing the tainted report. Successful exploitation enables high confidentiality (C:H) and integrity (I:H) impacts within the unchanged scope (S:U), allowing attackers to steal sensitive data, manipulate content, or impersonate users via injected scripts.
ManageEngine has issued an advisory detailing the issue at https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-4108.html, recommending upgrade to version 5802 or later to mitigate the vulnerability.
Details
- CWE(s)