CVE-2026-23608 is a stored cross-site scripting vulnerability (CWE-79) affecting GFI MailEssentials AI versions prior to 22.4. The issue arises from improper neutralization of input during web page generation at the Mail Monitoring rule creation endpoint. Authenticated users can supply malicious HTML/JavaScript in the JSON "name" field to the /MailEssentials/pages/MailSecurity/MailMonitoring.aspx/Save endpoint. This input is stored and later rendered in the management interface, enabling script execution in the context of other logged-in users. The vulnerability has a CVSS 4.0 score of 5.1, reflecting a medium risk level. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other logged-in users within the management interface. This could lead to session hijacking, unauthorized actions, or disclosure of sensitive information accessible to the victim user. The impact is limited by the requirement for authentication and the medium CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Mail Monitoring rule creation endpoint to trusted users only and consider monitoring for suspicious activity related to rule creation. Avoid using accounts with elevated privileges for routine tasks that involve this interface.