CVE-2026-3879 is a stored Cross-Site Scripting (XSS) vulnerability affecting ManageEngine Exchange Reporter Plus versions prior to 5802. This vulnerability allows an attacker to inject malicious scripts into the Equipment Mailbox Details report, potentially leading to session hijacking or defacement. Affected versions include those from 0 up to and including 5801. A patch is available in version 5802.
影响与攻击场景翻译中…
Successful exploitation of CVE-2026-3879 allows an attacker to inject arbitrary JavaScript code into the Equipment Mailbox Details report within ManageEngine Exchange Reporter Plus. When a user views this report, the injected script executes in their browser context, granting the attacker potential control over their session. This could lead to unauthorized access to sensitive data, including email content, user credentials, and system configurations. The attacker could also leverage this to perform phishing attacks or deface the application's interface. The scope of impact depends on the privileges of the affected user and the sensitivity of the data they access.
利用背景翻译中…
CVE-2026-3879 was publicly disclosed on 2026-04-03. No public proof-of-concept (POC) code has been released at the time of writing, but the XSS nature of the vulnerability makes it likely that a POC will emerge. The vulnerability is not currently listed on CISA KEV. The probability of exploitation is considered medium due to the ease of XSS exploitation and the potential impact.
哪些人处于风险中翻译中…
Organizations utilizing ManageEngine Exchange Reporter Plus for email reporting and analysis are at risk, particularly those running versions 0 through 5801. Environments with shared user accounts or where user input is not properly validated are especially vulnerable. Those relying on the Equipment Mailbox Details report for critical operational insights are also at increased risk.
检测步骤翻译中…
• manageengine / web:
curl -s -X POST "<exchange_reporter_plus_url>/reports/EquipmentMailboxDetails.aspx" -d "<input_field>=<xss_payload>" | grep -i "<xss_payload>"• generic web:
curl -s -X POST "<exchange_reporter_plus_url>/reports/EquipmentMailboxDetails.aspx" -d "<input_field>=<xss_payload>" | grep -i "<xss_payload>"攻击时间线
- Disclosure
disclosure
威胁情报
漏洞利用状态
EPSS
0.02% (5% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 低 — 任何有效用户账户均可。
- User Interaction
- 需要 — 受害者必须打开文件、点击链接或访问特制页面。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 高 — 攻击者可写入、修改或删除任何数据。
- Availability
- 无 — 无可用性影响。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2026-3879 is to upgrade ManageEngine Exchange Reporter Plus to version 5802 or later, which contains the fix. If an immediate upgrade is not possible, consider implementing input validation and output encoding on user-supplied data within the Equipment Mailbox Details report. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and sanitize user input to minimize the attack surface. After upgrade, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the Equipment Mailbox Details report and verifying that it is not executed.
修复方法翻译中…
Actualice ManageEngine Exchange Reporter Plus a la versión 5802 o posterior. Esta actualización corrige la vulnerabilidad XSS almacenada en el informe 'Equipment Mailbox Details'.
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2026-3879 — XSS in ManageEngine Exchange Reporter Plus?
CVE-2026-3879 is a stored Cross-Site Scripting (XSS) vulnerability in ManageEngine Exchange Reporter Plus versions 0–5802, allowing attackers to inject malicious scripts into the Equipment Mailbox Details report.
Am I affected by CVE-2026-3879 in ManageEngine Exchange Reporter Plus?
You are affected if you are running ManageEngine Exchange Reporter Plus versions 0 through 5801. Upgrade to version 5802 or later to mitigate the risk.
How do I fix CVE-2026-3879 in ManageEngine Exchange Reporter Plus?
Upgrade ManageEngine Exchange Reporter Plus to version 5802 or later. Input validation and WAF rules can provide temporary mitigation if an upgrade is not immediately possible.
Is CVE-2026-3879 being actively exploited?
While no active exploitation has been confirmed, the XSS nature of the vulnerability suggests a potential for exploitation. Monitor your systems for suspicious activity.
Where can I find the official ManageEngine advisory for CVE-2026-3879?
Refer to the official ManageEngine security advisory for CVE-2026-3879 on the ManageEngine website for detailed information and updates.