CVE-2026-28703: XSS in ManageEngine Exchange Reporter Plus

Successful exploitation of CVE-2026-28703 allows an attacker to inject arbitrary JavaScript code into the 'Mails Exchanged Between Users' report within ManageEngine Exchange Reporter Plus. When a user views this report, the injected script executes in their browser context. This can lead to various malicious outcomes, including session hijacking, credential theft (if the user is logged into other applications), and redirection to phishing sites. The attacker could potentially gain control of the user's account and access sensitive email data. The blast radius extends to all users who view the compromised report.

1. Reserved2026-03-13
2. Published2026-04-03
3. Modified2026-04-04
4. EPSS updated2026-04-10

The primary mitigation for CVE-2026-28703 is to upgrade ManageEngine Exchange Reporter Plus to version 5802 or later, which contains the fix. If immediate upgrading is not possible, consider restricting access to the 'Mails Exchanged Between Users' report to only authorized personnel. Implement strict input validation and output encoding on all user-supplied data within the report generation process as a temporary workaround. Monitor web application firewalls (WAFs) for suspicious JavaScript injection attempts targeting the report endpoint.