CVE-2025-59689
Medium 6.1 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Libraesva Email Security Gateway Command Injection Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.
Metrics
- CVSS 3.1
-
6.1 (MEDIUM)
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 2% (percentile: 80) as of 1 November 2026
- CWE
- CWE-77
Affected products
libraesva: email security gateway
References
- https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vu… Vendor Advisory
- https://www.libraesva.com/security-blog/ Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025… US Government Resource