CVE-2026-23609 is a stored cross-site scripting vulnerability (CWE-79) affecting GFI MailEssentials AI versions prior to 22.4. The issue exists in the Perimeter SMTP Servers configuration page, where an authenticated user can supply malicious HTML/JavaScript code through the ctl00$ContentPlaceHolder1$pv3$txtDescription parameter on the /MailEssentials/pages/MailSecurity/PerimeterSMTPServers.aspx endpoint. This input is stored and later rendered in the management interface without proper neutralization, enabling script execution in the context of logged-in users. The vulnerability has a CVSS 4.0 score of 5.1, reflecting medium impact with network attack vector, low complexity, and limited privileges required.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other logged-in users within the management interface. This can lead to unauthorized actions or disclosure of sensitive information accessible to the management interface user. The impact is limited by the requirement for authentication and the vulnerability's medium severity score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted users only and consider monitoring for suspicious activity. Avoid using untrusted input in the vulnerable parameter. Follow vendor updates closely for any released patches or official mitigations.