PT-2026-20899 · Gfi · Gfi Mailessentials

Alex Williams + 1 · Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-23619

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GFI MailEssentials AI versions prior to 22.4

Description GFI MailEssentials AI versions before 22.4 have a stored cross-site scripting issue in the Local Domains settings page. A logged-in user can inject HTML or JavaScript code into the ctl00$ContentPlaceHolder1$Pv3$txtDescription parameter of the ''/MailEssentials/pages/MailSecurity/general.aspx'' endpoint. This injected code is then saved and displayed within the management interface, enabling script execution within the user's session.

Recommendations Update GFI MailEssentials AI to version 22.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23619

Affected Products

Gfi Mailessentials

References · 7

• https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23619 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23619 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2024614847040635202 · Twitter Post
• https://vulncheck.com/advisories/gfi-mailessentials-ai-general-settings-local-domains-domain-description-stored-xss · Note
• https://t.me/CVEtracker/45161 · Telegram Post
• https://twitter.com/CVEnew/status/2025809108981686306 · Twitter Post