CVE-2026-112333 GFI Software CVE debrief

Who should care

Defenders responsible for GFI Archiver deployments should assess exposure and prioritize verification and remediation efforts. This includes administrators and security teams managing GFI Archiver installations, particularly those in environments where authenticated access to the MailInsights page is possible.

Why it matters

This stored cross-site scripting vulnerability in GFI Archiver before version 15.14 allows authenticated attackers to inject arbitrary web script or HTML, potentially impacting data integrity and confidentiality. Defenders should prioritize verifying exposure, assessing impact, and remediating vulnerable systems.

• Potential for authenticated attackers to inject malicious scripts
• Execution of injected payload in the browser of users who created scheduled reports
• Possible impact on data integrity and confidentiality
• Need for verification of GFI Archiver version and exposure

Technical summary

The vulnerability exists in the MailInsights scheduled report configuration of GFI Archiver versions prior to 15.14. Authenticated attackers can inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly those using GFI Archiver versions prior to 15.14.

Recommended defensive actions

• Verify GFI Archiver version and update to 15.14 or later if necessary
• Restrict access to the MailInsights scheduled report configuration
• Monitor for suspicious activity on the MailInsights page
• Perform a thorough review of existing scheduled reports for potential malicious scripts
• Implement additional logging and monitoring for MailInsights page interactions
• Conduct a security audit of GFI Archiver configurations to identify potential vulnerabilities
• Review and update incident response plans to include procedures for handling potential XSS attacks

Evidence notes

The CVE record and source item provide details about the vulnerability, including its existence in GFI Archiver versions prior to 15.14 and the potential for authenticated attackers to inject arbitrary web script or HTML.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.