MEDIUM CISA KEV

CVE-2025-59689

CVSS v3

6.1

MEDIUM

EPSS Score

5.2%

exploit probability

CISA KEV

Yes

known exploited

Exploitation

—

SSVC status

Description

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.

CISA Known Exploited Vulnerability

Date Added
9/29/2025
Patch Due Date
10/20/2025
Ransomware Use
Unknown

Technical details

Published
9/19/2025

Frequently asked questions

What is CVE-2025-59689?

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.

Is CVE-2025-59689 actively exploited?

Yes. CVE-2025-59689 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 10/20/2025.

What is the CVSS score for CVE-2025-59689?

CVE-2025-59689 has a CVSS v3 base score of 6.1 (MEDIUM severity).

Is CVE-2025-59689 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEs
Back to CVE Database