Microsoft Releases Urgent Fix for Windows Server Update Services RCE FLaw

Microsoft has released a critical security patch to address a severe remote code execution vulnerability affecting Windows Server Update Services (WSUS). The flaw is tracked as CVE-2025-59287 and is described as a network-based vulnerability that can be exploited via deserialization of untrusted data. It requires no authentication or user interaction to exploit, potentially allowing attackers to execute arbitrary code with the same privileges as the WSUS service account.

The CVSS 3.1 score is 9.8, placing it in the critical category, and Microsoft notes that an attacker with network access to a WSUS server could propagate the compromise across an organisation’s update infrastructure. The vulnerability was released on 14 October 2025 and last updated on 23 October 2025, and when exploited, could affect thousands of connected systems across a organisation’s IT infrastructure.

Administrators are urged to apply Microsoft’s patch promptly and review WSUS deployment topology, network segmentation, and monitoring around WSUS servers and update distribution.