CVE-2026-23616 is a stored cross-site scripting vulnerability affecting GFI MailEssentials AI versions before 22.4. It occurs on the Anti-Spoofing configuration page where an authenticated user can supply malicious HTML/JavaScript in the ctl00$ContentPlaceHolder1$AntiSpoofingGeneral1$TxtSmtpDesc parameter. This input is stored and later rendered in the management interface without proper neutralization, enabling script execution in the context of logged-in users. The vulnerability is classified under CWE-79 and has a CVSS 4.0 score of 5.1 (medium severity). No patch or official remediation guidance is currently available, and no known exploits have been reported.

Successful exploitation allows an authenticated user to execute arbitrary scripts within the management interface context, potentially leading to unauthorized actions such as session hijacking or manipulation of the management interface. The impact is limited by the requirement for authentication and the medium severity rating. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted users only and monitor for suspicious activity. Avoid entering untrusted input in the vulnerable parameter. Follow vendor updates for any forthcoming patches or mitigations.