Stored Cross-Site Scripting in GFI MailEssentials AI Product
CVE-2026-23608

5.1MEDIUM

Key Information:

Vendor

Gfi Software

Status
Mailessentials Ai
Vendor
CVE Published:
19 February 2026

What is CVE-2026-23608?

GFI MailEssentials AI versions prior to 22.4 are susceptible to a stored cross-site scripting vulnerability located in the Mail Monitoring rule creation endpoint. This vulnerability allows an authenticated user to inject malicious HTML or JavaScript through the JSON 'name' field during the creation of mail monitoring rules. The injected code is then stored and rendered in the management interface, potentially enabling script execution within the context of any logged-in user, which could lead to unauthorized actions or data exposure.

Affected Version(s)

MailEssentials AI 0 < 22.4

References

https://gfi.ai/products-and-solutions/network-security-so...
release-notespatch
https://www.vulncheck.com/advisories/gfi-mailessentials-a...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
VulnCheck
.