Critical Windows Server WSUS Vulnerability Exploited in the Wild

According to Microsoft, out-of-band updates were released to patch a critical WSUS remote code execution vulnerability, with exploitation observed just hours after the fixes were made available. The flaw, CVE-2025-59287, affects the Windows Server Update Service and impacts Windows Server 2012, 2016, 2019, 2022 and 2025. Security researchers published a PoC exploit on 18 October, warning that unauthenticated attackers could execute arbitrary code with System privileges.

Eye Security reported in-the-wild exploitation and noted roughly 2,500 WSUS instances worldwide remained exposed to attacks, while the Dutch National Cyber Security Centre also flagged active exploitation. CVE-2025-59287 relates to the WSUS Server Role, which is not enabled by default on Windows Server, so disabling the WSUS Server Role offers a temporary mitigation until patches are deployed. Microsoft says exploitation is more likely, but the advisory does not confirm active exploitation at scale. The information was compiled for SecurityWeek on 24 October 2025.