CVE-2018-9163: A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Bu...

Security readout for executives and security teams

This issue lets a logged-in Recovery Manager Plus user with technician-creation rights plant malicious script in a technician login name. The business risk is compromise of administrator browser sessions inside a privileged recovery-management console, not unauthenticated internet takeover. Exposure is likely limited to organizations still running Recovery Manager Plus earlier than 5.3 Build 5350, especially where technician administration is delegated broadly or the console is reachable by many internal users. Prioritize remediation where Recovery Manager Plus manages sensitive recovery operations or broad administrative access. This is not evidenced as actively exploited, but stored XSS in an admin console can support credential theft or session abuse. Mitigation focus: Upgrade Recovery Manager Plus to 5.3 Build 5350 or later, per vendor release context.; Review ManageEngine guidance for any additional fixed builds or hardening advice.; Limit Add New Technician permissions to trusted administrators only..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.