STATE-SPONSORED HACKERS EXPLOITING LIBRAESVA EMAIL SECURITY GATEWAY VULNERABILITY

Summary from the TLDR InfoSec newsletter

Libraesva has patched CVE-2025-59689, a command injection vulnerability in its Email Security Gateway with a CVSS score of 6.1, after discovering state-sponsored threat actors were actively exploiting it. The flaw can be triggered by malicious emails, allowing attackers to execute commands on the affected system. Organizations using Libraesva ESG should immediately apply the available security update to prevent exploitation.