CVE-2026-27655 — Cross-site Scripting in Manageengine Exchange Reporter Plus

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
4.8MEDIUMNVD
CNA7.3
EPSS
0.0%
top 96.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Zohocorp Manageengine Exchange Reporter Plus
Timeline
PublishedApr 3
Latest updateApr 10

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

3
VulDB
Zoho ManageEngine Exchange Reporter Plus up to 5801 Permissions Based on Mailboxes Report cross site scripting (Nessus ID 305773)↗2026-04-10
▶
CVEList
Stored XSS Vulnerability↗2026-04-03
▶
GHSA
GHSA-w39g-2rjc-rg77: Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report↗2026-04-03
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-27655 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-27655 — Cross-site Scripting | cvebase