Suspected state-sponsored attackers exploited a zero-day command injection vulnerability (CVE-2025-59689) in Libraesva Email Security Gateway (ESG), versions 4.5 to 5.5. The flaw, caused by improper sanitization of compressed email attachments, allowed arbitrary shell command execution under a non-privileged account. While patches (5.0.31, 5.1.20, 5.2.31, 5.3.16, 5.4.8, 5.5.7) were deployed automatically for supported versions, unsupported 4.x on-premise systems required manual upgrades. The attack’s precision—targeting single appliances—suggests a highly focused threat actor, likely a foreign hostile state. Libraesva’s response included automated scans for indicators of compromise and patch integrity verification, but the extent of data exposure or operational disruption remains undisclosed. The vulnerability’s exploitation could enable further lateral movement, data exfiltration, or persistent access, posing severe risks to organizations relying on the ESG for email security. No confirmation exists on whether customer or internal data was compromised, but the nature of the flaw and actor profile implies high potential for escalation.