Microsoft Issues Emergency Patch for Actively Exploited Critical WSUS Vulnerability

Microsoft issued out-of-band security updates on 23 October 2025 to patch a critical WSUS vulnerability that now faces active exploitation, with a proof-of-concept exploit publicly available. The flaw, CVE-2025-59287, is a remote code execution weakness in WSUS that carries a CVSS score of 9.8, and Microsoft notes it affects various Windows Server versions including Windows Server 2012 through 2025 (Server Core and standard editions).

Three researchers, MEOW, f7d8c52bec79e42795cf15888b85cbad and Markus Wulftange with CODE WHITE GmbH, are acknowledged for discovering and reporting the bug. In a hypothetical attack, a remote unauthenticated attacker could deserialise untrusted data to execute code over a network; HawkTrace security researcher Batuhan Er is cited for commentary on the issue arising from unsafe deserialisation of AuthorizationCookie objects.

The Dutch National Cyber Security Centre said it learned from a trusted partner that abuse of CVE-2025-59287 was observed on 24 October 2025, and observers have noted in-the-wild activity including a Base64-encoded payload dropped by a .NET executable.