Stored Cross-Site Scripting Vulnerability in GFI MailEssentials AI
CVE-2026-23606

5.1MEDIUM

Key Information:

Vendor

Gfi Software

Status
Mailessentials Ai
Vendor
CVE Published:
19 February 2026

What is CVE-2026-23606?

GFI MailEssentials AI prior to version 22.4 is affected by a stored cross-site scripting vulnerability in the rule creation workflow for Advanced Content Filtering. This security flaw allows an authenticated user to insert HTML and JavaScript via the 'txtRuleName' parameter on the advanced filtering page. The input is subsequently stored and rendered within the management interface, enabling potential script execution under the privileges of logged-in users, which could lead to further security risks.

Affected Version(s)

MailEssentials AI 0 < 22.4

References

https://gfi.ai/products-and-solutions/network-security-so...
release-notespatch
https://www.vulncheck.com/advisories/gfi-mailessentials-a...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
VulnCheck
.