CVE-2026-23620 is an arbitrary file existence enumeration vulnerability in GFI MailEssentials AI versions prior to 22.4. The flaw exists in the ListServer.IsDBExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist. An authenticated attacker can supply a filesystem path via the JSON key "path", which is URL-decoded and passed to the .NET File.Exists() method. This allows the attacker to determine whether arbitrary files exist on the server, potentially revealing sensitive information about the server's filesystem.

An authenticated user can confirm the presence or absence of arbitrary files on the affected server. While this does not allow direct file access or modification, it can aid attackers in reconnaissance and further exploitation by revealing file system structure or sensitive file locations. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the available data, users should monitor GFI Software advisories for updates. Restricting authenticated user access to the vulnerable web method or applying application-level input validation to restrict filesystem path inputs may help mitigate the risk until an official fix is available.