CVE-2026-23620 is an arbitrary file existence enumeration vulnerability in GFI MailEssentials AI versions before 22.4. The issue exists in the ListServer.IsDBExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist, which accepts an authenticated user's JSON input containing a 'path' key. This path is URL-decoded and passed directly to File.Exists() without restriction, allowing the user to determine if arbitrary files exist on the server filesystem. This observable discrepancy can leak information about the server's file structure. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3 and requires authentication to exploit. No patch or official remediation guidance is currently available.

An authenticated attacker can enumerate the existence of arbitrary files on the server running GFI MailEssentials AI prior to version 22.4. This information disclosure could facilitate further attacks by revealing sensitive file locations or confirming the presence of specific files. There is no indication of direct code execution or privilege escalation from this vulnerability alone. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected web method to trusted authenticated users only and monitor for suspicious activity. Avoid exposing the vulnerable endpoint to untrusted networks. Follow vendor communications for updates on patches or official mitigations.