Loading story…
Libraesva issued an emergency update for its Email Security Gateway (ESG) after discovering active exploitation of a command injection vulnerability, CVE-2025-59689, by suspected state-sponsored actors. The flaw allows arbitrary command execution via malicious email attachments and affects all ESG versions from 4.5 onward. The patch, released within 17 hours of detection, includes a sanitization fix, automated compromise scanning, and a self-assessment module.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On September 23-24, 2025, Libraesva and multiple security outlets disclosed that CVE-2025-59689 was being exploited in the wild and published technical details describing improper sanitization of files inside certain archive formats as the root cause. Customers were urged to deploy patches quickly because exploitation can be delivered through email-borne attachments.
After detecting the abuse, Libraesva issued security updates for supported 5.x branches within 17 hours to fix the command injection flaw affecting ESG versions 4.5 through 5.5.x before 5.5.7. The unsupported 4.x branch remained end-of-life and did not receive a fix.
Libraesva confirmed at least one real-world exploitation incident involving CVE-2025-59689, where a malicious email with a specially crafted compressed attachment triggered command execution on one Email Security Gateway appliance. The company assessed the operation as a precise attack by a foreign hostile state entity.
7 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcesecurityaffairs.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed active exploitation of **CVE-2026-76461**, an SQL injection flaw affecting Cisco Secure Email Gateway deployments. The vulnerability affects unpatched releases of Cisco AsyncOS for Cisco Secure Email Gateway, Cisco Secure Email Gateway, and Cisco Secure Email and Web Manager. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities Catalog, while the Canadian Centre for Cyber Security issued advisory **AV26-921**. Cisco has released a September 2026 security-hardening update; administrators should identify affected appliances and management systems and apply Cisco’s prescribed fixed releases promptly.
Sep 19, 2026
Researchers disclosed multiple critical vulnerabilities in the **SEPPMail Secure E-Mail Gateway** that can let attackers achieve remote code execution, read arbitrary files and emails, and maintain persistent control of the appliance. InfoGuard Labs said the exposed web UI and newer **GINA v2** interface are affected, with the most severe issues including `CVE-2026-2743`, an authenticated path traversal in the Large File Transfer component that can be chained into arbitrary file write and code execution, `CVE-2026-44128`, an unauthenticated Perl injection leading to RCE, `CVE-2026-44127`, a local file inclusion and arbitrary file deletion flaw, and `CVE-2026-7864`, an information disclosure bug exposing environment variables through a debug endpoint. The researchers described a practical takeover path in which an attacker overwrites `/etc/syslog.conf` and triggers a syslog reload via log rotation to obtain a Perl-based reverse shell, giving full control of the gateway and access to all mail traffic. They warned that the product is widely deployed, particularly in the DACH region, with thousands of internet-exposed instances visible, making the flaws a potential entry point into internal networks. SEPPMail released fixes across versions **15.0.2.1**, **15.0.3**, and **15.0.4**, while public reporting highlighted that successful exploitation could expose sensitive email content and enable long-term compromise of affected organizations.
Jun 29, 2026
Barracuda disclosed that its Email Security Gateway appliances were compromised through `CVE-2023-2868`, a zero-day in the Amavis antivirus scanning module that improperly sanitized `.tar` file contents in email attachments, enabling remote command execution and full takeover of affected physical appliances. The flaw affected ESG versions `5.1.3.001` through `9.2.0.006`, and Barracuda issued patch `BNSF-36456`; however, the company and outside researchers warned that patching alone was insufficient because attackers could maintain persistence after exploitation, leading Barracuda to advise customers to replace impacted hardware rather than simply update it. Reporting from Mandiant, Rapid7, KrebsOnSecurity, The Record, and government advisories said the intrusions were linked to a China-backed espionage group and involved multiple backdoors and implants, including **SALTWATER**, **SEASIDE**, **SEASPY**, **SEASPY v2**, **WHIRPOOL**, and **SEASPRAY**. CISA highlighted the incident as evidence of persistent risk at the network edge, while responders urged organizations to rotate credentials, reissue certificates, hunt for indicators of compromise, investigate lateral movement, and assess possible data exfiltration from any exposed Barracuda ESG device.
Aug 8, 2026