Is CVE-2026-4107 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4107 being exploited in the wild.

How severe is CVE-2026-4107?

High severity, with a CVSS score of 7.3, published 3 April 2026.

Which products and versions are affected?

Zoho Corporation Exchange Reporter Plus Builds 5801 and below.

Is there a fix for CVE-2026-4107?

A patch was published on 2026-03-19: Fixed in version 5802 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4107 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-4107?

Check whether you run Zoho Corporation Exchange Reporter Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4107: Zohocorp ManageEngine Exchange Reporter Plus Stored XSS in Reports

CVE-2026-4107 · Severity: high · CVSS 7.3 · Published 2026-04-03

ManageEngine Exchange Reporter Plus is a reporting and monitoring solution for Microsoft Exchange environments. A security vulnerability in the 'Folder Message Count and Size' report allows an authenticated user to inject malicious scripts into the system. If an administrator or another user views the compromised report, the attacker could gain unauthorized access to the application or perform actions on behalf of the victim.

Technologies: Zoho Corporation Exchange Reporter Plus. Vendors: Zoho Corporation.

Quick answers

Is CVE-2026-4107 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4107 being exploited in the wild.
How severe is CVE-2026-4107?: High severity, with a CVSS score of 7.3, published 3 April 2026.
Which products and versions are affected?: Zoho Corporation Exchange Reporter Plus Builds 5801 and below.
Is there a fix for CVE-2026-4107?: A patch was published on 2026-03-19: Fixed in version 5802 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4107 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-4107?: Check whether you run Zoho Corporation Exchange Reporter Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in ManageEngine Exchange Reporter Plus builds 5801 and below. The flaw is located within the 'Folder Message Count and Size' report component due to improper neutralization of input during web page generation (CWE-79). An authenticated attacker, typically a mailbox user within the Exchange organization, can inject malicious scripts that are stored on the server. When a victim (such as an administrator) interacts with the affected report, the script executes in their browser context, potentially leading to session hijacking or unauthorized administrative actions. The issue is resolved in version 5802 through improved input validation.

Affected products

Zohocorp ManageEngine Exchange Reporter Plus Builds 5801 and below

Timeline

2026-03-19: patched: Fixed in version 5802
2026-04-03: advisory: Initial advisory published by ManageEngine and NVD

References

https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-4107.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.