Is CVE-2025-59689 exploited in the wild?

Yes. CVE-2025-59689 is known to be exploited in the wild, first recorded on 29 September 2025. Treat it as urgent.

How severe is CVE-2025-59689?

Critical severity, with a CVSS score of 6.1, published 29 September 2025.

Which products and versions are affected?

Libraesva Email Security Gateway 4.5 through 5.5.x before 5.5.7 (specifically: < 5.0.31, < 5.1.20, < 5.2.31, < 5.4.8, < 5.5.7).

Is there a fix for CVE-2025-59689?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-59689 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-59689?

Check whether you run Libraesva Email Security Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59689: Libraesva Email Security Gateway command injection via compressed attachment

Q: Is there a fix for CVE-2025-59689?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-59689 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-59689?

Check whether you run Libraesva Email Security Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59689 · Severity: critical · CVSS 6.1 · Exploited in the wild · Published 2025-09-29

Libraesva Email Security Gateway, a solution used to filter and protect corporate email traffic, is vulnerable to a security flaw that allows attackers to execute unauthorized commands. By sending a specially crafted compressed email attachment, an attacker can compromise the gateway. This vulnerability has been observed being used in active attacks, potentially leading to unauthorized access or disruption of email services.

Quick answers

Is CVE-2025-59689 exploited in the wild?: Yes. CVE-2025-59689 is known to be exploited in the wild, first recorded on 29 September 2025. Treat it as urgent.
How severe is CVE-2025-59689?: Critical severity, with a CVSS score of 6.1, published 29 September 2025.
Which products and versions are affected?: Libraesva Email Security Gateway 4.5 through 5.5.x before 5.5.7 (specifically: < 5.0.31, < 5.1.20, < 5.2.31, < 5.4.8, < 5.5.7).
Is there a fix for CVE-2025-59689?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-59689 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-59689?: Check whether you run Libraesva Email Security Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability (CWE-77) exists in Libraesva ESG versions 4.5 through 5.5.x. The flaw is triggered when the gateway processes a specially crafted compressed email attachment. An unauthenticated remote attacker can exploit this by sending a malicious email to a user protected by the gateway, leading to arbitrary command execution on the underlying operating system. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Patches have been released for various major versions, including 5.0.31, 5.1.20, 5.2.31, 5.4.8, and 5.5.7.

Affected products

Libraesva Email Security Gateway (ESG) 4.5 through 5.5.x before 5.5.7 (specifically: < 5.0.31, < 5.1.20, < 5.2.31, < 5.4.8, < 5.5.7)

Timeline

2025-09-19: disclosed: Initial CVE publication
2025-09-29: kev added: Added to CISA Known Exploited Vulnerabilities catalog
2025-09-29: advisory: Vendor security advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.