CVE-2026-23614Disclosure(gfi / mailessentials)

LOWCVSS 5.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Sender Policy Framework IP Exceptions interface. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv2$txtIPDescription parameter to /MailEssentials/pages/MailSecurity/SenderPolicyFramework.aspx, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.

gfi CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.vulncheck.com/advisories/gfi-mailessentials-ai-anti-spam-sender-policy-framework-ip-exceptions-description-stored-xss

Other references

https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mailessentials

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

gfi

Products

mailessentials

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets2 URLs

By indicator

Full discourse1 post

Vulmon Vulnerability Feed@VulmonFeeds232d
Disclosure
CVE-2026-23614 Stored XSS in GFI MailEssentials AI Sender Policy Framework IP Ex... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23614 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
A stored cross‑site scripting vulnerability (CVE-2026-23614) affecting GFI MailEssentials AI SPF IP Ex has been announced; no PoC, exploit, or active exploitation details are provided.
0001046
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gfi	mailessentials	-	-	-

Explore more

Back to dashboard gfi CVEs mailessentials vulnerabilities