CVE-2025-59287: Microsoft fixes critical WSUS flaw under active attack

According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Microsoft released an out-of-band security update to address CVE-2025-59287, a critical WSUS remote code execution flaw that is under active exploitation. The vulnerability, rated CVSS 9.8, stems from deserialization of untrusted data in Windows Server Update Service and could allow a remote, unauthenticated attacker to execute code with SYSTEM privileges via the GetCookie() endpoint.

Microsoft specifies that the update covers supported Windows Server editions including Windows Server 2012, 2012 R2, 2016, 2019, 2022, the 23H2 Server Core edition, and Windows Server 2025, and notes that a reboot is required after installation. Hawktrace published a PoC for CVE-2025-59287, while Eye Security described an in-the-wild payload chain, and the Dutch NCSC confirmed attacks in the wild on 24 October 2025.

Huntress detected probing activity from 23 October 2025, with attackers sending crafted POSTs to exposed WSUS endpoints that spawned cmd.exe and PowerShell and exfiltrated data to a webhook site. Microsoft has re-released the patch, and researchers emphasise that mitigation requires secure serialization and proper input sanitisation of cookie data.