Security readout for executives and security teams
Plain-English summary
An authenticated MailEssentials AI user could ask the server whether arbitrary filesystem paths exist. This does not read or change files, but it can reveal sensitive server details that help attackers plan follow-on activity.
Executive priority
Treat this as a moderate-priority patching and exposure-reduction issue, especially on internet-adjacent mail security infrastructure. It is not described as active exploitation, but it can aid reconnaissance after authentication.
Technical view
Versions before MailEssentials AI 22.4 expose ListServer.IsDBExist() at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist. The JSON path value is URL-decoded and passed to File.Exists() without path restriction, allowing authenticated file-existence enumeration. CVSS 4.0 score is 5.3.
Likely exposure
Exposure is most likely where GFI MailEssentials AI before 22.4 is deployed and authenticated users can reach the MailSecurity ListServer web method over the network.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The issue requires low-privileged authenticated access and network reachability, with impact limited to confirming file existence.
Researcher notes
The CVE maps to CWE-203 because the observable response reveals whether a file exists. Version evidence in the bundle points to MailEssentials AI before 22.4, but affected-version metadata is limited, so verify against vendor release notes.
Mitigation direction
- Upgrade GFI MailEssentials AI to 22.4 or later per vendor release guidance.
- Review GFI and VulnCheck advisories for any updated remediation details.
- Restrict MailEssentials web access to trusted networks or VPN users.
- Limit accounts that can authenticate to MailEssentials administrative functions.
- Monitor application logs for unusual ListServer IsDBExist access patterns.
Validation and detection
- Inventory MailEssentials AI deployments and confirm installed versions.
- Check whether vulnerable web paths are reachable from untrusted networks.
- Review authenticated user roles with access to MailSecurity pages.
- Search logs for requests to the ListServer IsDBExist web method.
- Confirm the upgrade or vendor-recommended mitigation is applied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-203: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-23620 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.81.4VulnCheckVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releasesCVE reference, VulnCheck · release-notes, patch
- https://www.vulncheck.com/advisories/gfi-mailessentials-ai-listserver-isdbexist-absolute-directory-traversal-to-file-enumerationCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Observable Discrepancy
Observable Discrepancy represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.