This vulnerability (CVE-2026-23614) affects GFI MailEssentials AI before version 22.4 and involves improper neutralization of input leading to stored cross-site scripting (CWE-79). An authenticated user can supply malicious HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv2$txtIPDescription parameter on the Sender Policy Framework IP Exceptions page (/MailEssentials/pages/MailSecurity/SenderPolicyFramework.aspx). The injected script is stored and executed later in the management interface, potentially allowing script execution in the context of a logged-in user. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other logged-in users of the management interface. This could lead to actions such as session hijacking or unauthorized actions within the management interface. However, the impact is limited by the requirement for authentication and user interaction, and the overall severity is rated medium (CVSS 5.1). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor GFI Software advisories for updates. Until a fix is available, restrict access to the management interface to trusted users only and consider additional input validation or filtering controls if possible. Avoid using accounts with elevated privileges for routine access to the affected interface.