Stored Cross-Site Scripting Vulnerability in GFI MailEssentials AI
CVE-2026-23611

5.1MEDIUM

Key Information:

Vendor

Gfi Software

Status
Mailessentials Ai
Vendor
CVE Published:
19 February 2026

What is CVE-2026-23611?

GFI MailEssentials AI prior to version 22.4 has a stored cross-site scripting (XSS) vulnerability in the management interface of the IP Blocklist page. An authenticated user can exploit this vulnerability by injecting malicious HTML or JavaScript through the IP description field. The injected scripts are then stored and can be executed when the page is viewed by other logged-in users, potentially allowing attackers to execute arbitrary scripts in the context of the users' sessions.

Affected Version(s)

MailEssentials AI 0 < 22.4

References

https://gfi.ai/products-and-solutions/network-security-so...
release-notespatch
https://www.vulncheck.com/advisories/gfi-mailessentials-a...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
VulnCheck
.