Microsoft WSUS CVE-2025-59287: Unauthenticated SYSTEM RCE

What to do

1. Inventory WSUS servers with Get-WindowsFeature -Name UpdateServices
2. Install the October 23, 2025 out-of-band update (or a later cumulative update) and reboot
3. If you cannot patch yet, disable the WSUS role or block inbound TCP 8530/8531 at the host firewall, and leave the workaround in place until patched
4. Ensure WSUS is never reachable from the internet; allow only the management hosts and clients that need it
5. Hunt for child processes of wsusservice.exe and w3wp.exe on WSUS servers

How to check if you are affected or compromised

• Alert on cmd.exe/powershell.exe spawned by wsusservice.exe or w3wp.exe (WSUS app pool), especially base64-encoded PowerShell
• Review C:\Program Files\Update Services\Logfiles\SoftwareDistribution.log for deserialization exceptions
• Check IIS logs for unusual POSTs to /ClientWebService/Client.asmx, /SimpleAuthWebService/SimpleAuth.asmx and /ReportingWebService/ReportingWebService.asmx
• Look for outbound connections from WSUS servers to webhook.site or other paste/webhook services

What happened#

Microsoft first fixed CVE-2025-59287, a deserialization flaw in Windows Server Update Services (WSUS), in the October 14, 2025 Patch Tuesday release. That fix turned out to be incomplete. On October 23, Microsoft shipped an emergency out-of-band update. CISA's alert says the bug lets "an unauthenticated actor" achieve "remote code execution with SYSTEM-level privileges." The CVE record carries a Microsoft CVSS 3.1 score of 9.8.

Exploitation followed within hours. Huntress saw its first attack at about 23:34 UTC on October 23, against WSUS instances exposed on their default ports, TCP 8530 and 8531. CISA added the flaw to the KEV catalog on October 24, with a federal deadline of November 14, 2025.

According to Unit 42, there are two routes to the bug. One sends a crafted AuthorizationCookie to the GetCookie() endpoint, which deserializes it with BinaryFormatter. The other goes through the ReportingWebService and uses SoapFormatter. Observed post-exploitation was mostly reconnaissance: domain user and network enumeration, with the output posted to a webhook.site URL.

Who is affected#

Windows Server 2012 through 2025 are affected, but only when the WSUS Server Role is enabled. Unit 42 notes that the role is not enabled by default. Ordinary servers and endpoints that merely receive updates from WSUS are not the vulnerable component. Unit 42's Cortex Xpanse counted roughly 5,500 WSUS instances exposed to the internet.

Do you really need to act?#

Most organizations have only a handful of WSUS servers, and few expose them to the internet. Huntress saw exploitation at four customers and about 25 susceptible hosts across its partner base, and expected exploitation to stay limited for that reason. So this is not a "the whole fleet is burning" event.

The servers that are affected matter a great deal, though. A WSUS server is trusted to push software to every managed Windows machine, typically sits on the internal network with broad reach, and this bug gives SYSTEM without credentials. An attacker who already has a foothold inside can use it to escalate laterally even if the server isn't exposed to the internet. Patch every WSUS server this week. Treat any server that was reachable on 8530/8531 from the internet between October 23 and your patch date as a possible incident.

What to do now#

1. Find WSUS servers: Get-WindowsFeature -Name UpdateServices in PowerShell, or check Server Manager for the role.
2. Install the October 23, 2025 out-of-band update, or any later cumulative update for that Windows Server version, then reboot. The October 14 update alone is not enough.
3. If you cannot patch immediately, CISA's workaround is to disable the WSUS role or block inbound TCP 8530 and 8531 at the host firewall. Either one stops update distribution, and CISA says not to undo it until the patch is installed.
4. Restrict WSUS ports to the clients and management hosts that need them, and never publish WSUS to the internet.
5. Update the remaining Windows servers in the same cycle.

How to tell if you were hit#

• Process chains wsusservice.exe → cmd.exe → cmd.exe → powershell.exe or w3wp.exe → cmd.exe → cmd.exe → powershell.exe, both reported by Huntress and Unit 42. CISA also flags nested PowerShell with base64-encoded commands.
• Deserialization exceptions in C:\Program Files\Update Services\Logfiles\SoftwareDistribution.log.
• IIS logs (C:\inetpub\logs\LogFiles\W3SVC*\) showing unusual POSTs to /ClientWebService/Client.asmx, /SimpleAuthWebService/SimpleAuth.asmx, /ReportingWebService/ReportingWebService.asmx or /ApiRemoting30/WebService.asmx.
• Recon commands such as whoami; net user /domain and ipconfig /all run as SYSTEM, followed by outbound traffic to webhook.site.

Timeline#

• Oct 14, 2025 — Initial (incomplete) fix in Patch Tuesday; CVE published.
• Oct 23, 2025 — Microsoft releases the out-of-band update; exploitation begins within hours.
• Oct 24, 2025 — CISA alert; added to KEV.
• Oct 29, 2025 — CISA revises its alert with detection guidance.
• Nov 14, 2025 — KEV remediation deadline for US federal agencies.

Vulnerability records

• CVE-2025-59287 · KEV 2025-10-24 · Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE.org — CVE-2025-59287 cve.org
2. CISA — Microsoft Releases Out-of-Band Security Update to Mitigate WSUS Vulnerability, CVE-2025-59287 cisa.gov
3. CISA — Known Exploited Vulnerabilities catalog (JSON feed) cisa.gov
4. Huntress — Exploitation of Windows Server Update Services Remote Code Execution Vulnerability huntress.com
5. Palo Alto Networks Unit 42 — Threat Brief: CVE-2025-59287 unit42.paloaltonetworks.com