CISA Issues Alert on Actively Exploited Libraesva ESG Command Injection Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert about the active exploitation of a vulnerability in Libraesva ESG, catalogued as CVE-2025-59689, which affects how the Email Security Gateway processes compressed attachments. The alert notes that exploiting this command injection flaw can allow attackers to execute arbitrary commands on the underlying system, potentially bypassing security controls and accessing sensitive infrastructure.

It also states that CVE-2025-59689 is included in CISA’s Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency for defenders. Mitigations urge organisations running Libraesva ESG to apply vendor-provided mitigations immediately, and where patches are unavailable to follow Federal Binding Operational Directive 22-01 guidance for cloud services or discontinue use of the affected product, with KEV monitoring recommended as part of vulnerability management.

This warning, according to CISA, reflects evidence that the vulnerability is being actively exploited in the wild and highlights the risk to enterprises relying on email security gateways.