manageengine exchange reporter plus vulnerabilities and fixes

Recent CVEs affecting manageengine exchange reporter plus, with upgrade or downgrade steps. 8 tracked.

Also searched as: manageengineexchangereporterplus.

manageengine exchange reporter plus has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2026-04-03. Highest priority: CVE-2026-28754 (score 37/100).

CVE-2026-28754 HIGH 7.3 UPGRADE Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution
CVE-2026-28756 HIGH 7.3 UPGRADE Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions
CVE-2026-28703 HIGH 7.3 UPGRADE Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchan
CVE-2026-3879 HIGH 7.3 UPGRADE Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Ma
CVE-2026-3880 HIGH 7.3 UPGRADE Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folde
CVE-2026-4107 HIGH 7.3 UPGRADE Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Messa
CVE-2026-4108 HIGH 7.3 UPGRADE Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Ma
CVE-2026-27655 HIGH 7.3 UPGRADE Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions

FAQ

How do I fix manageengine exchange reporter plus vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is manageengine exchange reporter plus being exploited right now?

None of the tracked manageengine exchange reporter plus CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which manageengine exchange reporter plus CVE should I patch first?

CVE-2026-28754 currently ranks highest (37/100): Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution.

RSS feed for manageengine exchange reporter plus · ← Back to latest CVEs