Stored Cross-Site Scripting in GFI MailEssentials AI Configuration
CVE-2026-23609

5.1MEDIUM

Key Information:

Vendor

Gfi Software

Status
Mailessentials Ai
Vendor
CVE Published:
19 February 2026

What is CVE-2026-23609?

GFI MailEssentials AI prior to version 22.4 features a stored cross-site scripting vulnerability affecting the configuration settings of Perimeter SMTP Servers. Authenticated users can exploit this flaw by injecting malicious HTML or JavaScript into the 'Description' field on the management interface. This injected script can be executed in the context of a logged-in user, potentially leading to unauthorized access or data exposure. It is crucial for users to update to the latest version to mitigate this security threat.

Affected Version(s)

MailEssentials AI 0 < 22.4

References

https://gfi.ai/products-and-solutions/network-security-so...
release-notespatch
https://www.vulncheck.com/advisories/gfi-mailessentials-a...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
VulnCheck
.