CVE-2026-27655: Zohocorp ManageEngine Exchange Reporter Plus

Medium severity, CVSS 4.8. EPSS: 1% chance of exploitation in the next 30 days.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.

Affected products

• Zohocorp ManageEngine Exchange Reporter Plus: before 5.8 (fixed in 5.8); version 5.8 only

Published 2026-04-03. Last modified 2026-07-20.