Libraesva Email Security Gateway Vulnerability Exploited by Nation-State Hackers

Libraesva has addressed a vulnerability in its integrated email security platform that has been exploited in the wild, tracked as CVE-2025-59689, with a CVSS score of 6.1. The flaw is described as a command injection issue that could allow arbitrary commands to be executed as a non-privileged user, triggered by malicious emails containing crafted compressed attachments.

According to Libraesva’s advisory, the bug can be exploited via specific archive formats that exploit improper input sanitization during the removal of active code from files in some compressed formats. The vulnerability affects Libraesva ESG versions 4.5 through 5.5, although patches were released only for ESG 5.x versions, since 4.x is discontinued.

Libraesva has pushed patches to both cloud and on-premise deployments, and all appliances are now running a fixed software iteration; customers on on‑premise ESG 4.x are advised to manually update to a patched 5.x version as soon as possible, given that the vulnerability has been exploited. One confirmed incident of abuse has been identified, and the threat actor is believed to be a foreign hostile state entity, underscoring the need for rapid, comprehensive patch deployment.