Critical vulnerability discovered in ManageEngine Exchange Reporter Plus
Take action: If you're running ManageEngine Exchange Reporter Plus build 5721 or older, you have a critical vulnerability that lets attackers take over your server completely. You are not safe just because this tool is internal to your organizations - hackers can breach credentials, and malicious insiders can abuse the system. Update to build 5722 or later ASAP.
Learn More
ManageEngine has addressed a critical vulnerability in Exchange Reporter Plus, an email monitoring and reporting solution deployed across enterprise environments.
The flaw is tracked as CVE-2025-3835 (CVSS score 9.6) and allows authenticated attackers to execute arbitrary commands on servers hosting Exchange Reporter Plus installations, potentially leading to complete system compromise. The vulnerability is within the Content Search module, a component used for searching and analyzing email data and communications.
Vulnerable Versions:
- ManageEngine Exchange Reporter Plus all builds numbered 5721 and below are affected by this critical vulnerability
Fixed Versions:
- ManageEngine Exchange Reporter Plus build 5722 and later versions contain the security patches that remediate this vulnerability
The company is strongly urging all customers to implement the update immediately. Organizations can obtain the latest service pack through ManageEngine's official distribution channels and should follow the provided installation instructions carefully to ensure proper deployment.
