CVE-2026-23621 describes an arbitrary directory existence enumeration vulnerability in GFI MailEssentials AI versions prior to 22.4. The issue exists in the ListServer.IsPathExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist. An authenticated user can supply an unrestricted filesystem path via the JSON key "path", which is URL-decoded and passed to the .NET Directory.Exists() function. This allows the attacker to determine whether arbitrary directories exist on the server, potentially aiding further reconnaissance or attack planning. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3 and does not require user interaction. No patch or vendor advisory is currently provided.

An authenticated attacker can enumerate the existence of arbitrary directories on the affected server. This information disclosure can assist in further attacks or reconnaissance but does not directly allow code execution or data modification. The impact is limited to information disclosure about the server's filesystem structure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to the vulnerable web method if possible and monitor for suspicious activity related to directory enumeration attempts.