Windows Server Update Services (WSUS) Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-59287)
Executive & SecOps Summary
SECOPS ASSESSMENTAll Windows Server environments running Windows Server Update Services (WSUS).
Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges over the network by sending malicious serialized payloads.
Apply the official Microsoft security patches immediately, and restrict network access to WSUS ports (8530, 8531) to trusted internal networks.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Refer to the Microsoft Security Update Guide and apply the latest Cumulative Update (LCU) immediately. Use the following PowerShell commands to check, install updates, and restart WSUS services.
# Install and run Windows Update module to apply the latest security patches
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -AcceptAll -Install -AutoReboot
# Restart IIS and WSUS services to ensure patch application
Restart-Service -Name 'W3SVC' -Force
Restart-Service -Name 'WsusService' -Force2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to WSUS ports (TCP 8530, 8531) using Windows Firewall to allow only trusted internal subnets.
# Block external access to WSUS HTTP/HTTPS ports
New-NetFirewallRule -DisplayName 'Block-External-WSUS-HTTP' -Direction Inbound -LocalPort 8530 -Protocol TCP -Action Block
New-NetFirewallRule -DisplayName 'Block-External-WSUS-HTTPS' -Direction Inbound -LocalPort 8531 -Protocol TCP -Action Block
# Allow access only from trusted internal network (e.g., 10.0.0.0/8)
New-NetFirewallRule -DisplayName 'Allow-Internal-WSUS-HTTP' -Direction Inbound -LocalPort 8530 -Protocol TCP -RemoteAddress '10.0.0.0/8' -Action Allow3. Log Audit & IoC Verification Commands
Audit IIS logs and Event Viewer logs to detect anomalous SOAP requests or deserialization errors.
# Search IIS logs for suspicious POST requests to the WSUS client web service
$IISLogPath = 'C:\inetpub\logs\LogFiles\W3SVC*\*.log'
Select-String -Path $IISLogPath -Pattern 'POST /ClientWebService/client.asmx' | Select-Object -First 50
# Query Event Viewer for WSUS application errors
Get-WinEvent -LogName 'Application' | Where-Object { $_.ProviderName -eq 'Windows Server Update Services' -and $_.LevelDisplayName -eq 'Error' } | Select-Object TimeCreated, Id, Message -First 20Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-59287) is a critical remote code execution (RCE) flaw in Windows Server Update Services (WSUS) caused by the deserialization of untrusted data (CWE-502). The root cause lies in the WSUS API endpoints failing to properly validate and sanitize serialized objects received from clients or downstream servers. An attacker can exploit this by sending a crafted .NET serialization payload to trigger arbitrary code execution on the server.
2. Exploitation Mechanics & Attack Scenario
An attacker targets the HTTP/HTTPS ports (default TCP 8530 and 8531) used by WSUS for communication. By sending a malicious SOAP request containing a .NET gadget chain (such as TypeConfuseDelegate) to unauthenticated web service endpoints, the attacker forces the WSUS service to deserialize the payload. Upon deserialization, the payload executes arbitrary system commands under the security context of 'NT AUTHORITY\SYSTEM', leading to complete server compromise.
3. Infrastructure & Business Impact
WSUS is a critical infrastructure component responsible for patch management and distribution across enterprise networks. This vulnerability has a CVSS score of 9.8 and is listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation in the wild. A compromised WSUS server allows attackers to perform lateral movement, deploy ransomware, or distribute malicious updates to downstream clients, posing a severe threat to the entire enterprise network.
Official Vendor Advisories & References
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Frequently Asked SecOps Questions (CVE-2025-59287)
FAQQ1. How critical is CVE-2025-59287 and is it actively exploited in the wild?
CVE-2025-59287 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-59287?
Primary impacted vendors include microsoft across windows server, windows server update services. Scope summary: All supported versions of Windows Server running Windows Server Update Services (WSUS)
Q3. What temporary mitigations or workarounds exist for CVE-2025-59287 before patching?
[Mitigation] Apply the official Microsoft security patches immediately, and restrict network access to WSUS ports (8530, 8531) to trusted internal networks. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-59287
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Microsoft Active Directory Federation Services (AD FS) Privilege Escalation Vulnerability (CVE-2026-56155) Security Advisory
[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled
Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.