PT-2026-20886 · Gfi · Gfi Mailessentials

Alex Williams + 1 · Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-23606

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GFI MailEssentials AI versions prior to 22.4

Description The software contains a stored cross-site scripting issue in the Advanced Content Filtering rule creation workflow. A logged-in user can inject HTML or JavaScript code via the txtRuleName parameter of the '/MailEssentials/pages/MailSecurity/advancedfiltering.aspx' API endpoint. This injected code is then stored and displayed within the management interface, leading to script execution within the user's session.

Recommendations Update to version 22.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23606

Affected Products

Gfi Mailessentials

References · 8

• https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases · Patch
• https://osv.dev/vulnerability/CVE-2026-23606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23606 · Security Note
• https://twitter.com/CVEnew/status/2025892038474879150 · Twitter Post
• https://vulncheck.com/advisories/gfi-mailessentials-ai-advanced-content-filtering-rule-stored-xss · Note
• https://t.me/CVEtracker/45148 · Telegram Post
• https://t.me/cveNotify/152622 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2024650684927222229 · Twitter Post