CVE-2025-59689

CVE-2025-59689 is a command injection flaw (CWE-77) in Libraesva Email Security Gateway versions 4.5 through 5.5.x before 5.5.7. It is triggered when the gateway processes a crafted compressed email attachment; per the CVSS vector, no privileges are required but user interaction is involved, and the injection lets an attacker run arbitrary commands with impact that extends beyond the affected component (scope change). Any organization running an affected Libraesva ESG release is in scope, with email security gateways typically sitting in the mail flow and handling untrusted inbound attachments. The flaw is being actively exploited, with public reports attributing exploitation to state-sponsored actors, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-09-29.

What to do: Upgrade to the fixed release for your deployed line: 5.5.7, 5.4.8, 5.2.31, 5.1.20, or 5.0.31. Because the flaw is actively exploited, including by nation-state actors, review gateway logs and compressed-attachment handling for signs of compromise after patching; organizations subject to BOD 22-01 must apply vendor mitigations or discontinue use of the product.