CVE-2026-23612 is a stored cross-site scripting vulnerability (CWE-79) affecting GFI MailEssentials AI versions prior to 22.4. The issue exists in the IP DNS Blocklist configuration page where an authenticated user can supply HTML or JavaScript code through the ctl00$ContentPlaceHolder1$pv1$TXB_IPs parameter. This input is stored and later rendered in the management interface without proper neutralization, enabling script execution in the context of logged-in users. The vulnerability has a CVSS 4.0 score of 5.1, reflecting medium severity with network attack vector, low privileges required, and partial impact on confidentiality and integrity.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other logged-in users within the management interface. This can lead to actions such as session hijacking, unauthorized actions, or information disclosure limited to the management interface context. The impact on confidentiality and integrity is low, and availability is not affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the IP DNS Blocklist configuration page to trusted administrators only and monitor for suspicious activity. Avoid entering untrusted input in the affected parameter. Follow up with GFI Software for updates or patches addressing this vulnerability.