Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild

According to Unit 42, Microsoft’s Windows Server Update Services (WSUS) suffered a critical Remote Code Execution vulnerability, CVE-2025-59287, with a CVSS of 9.8. On 14 October 2025, the flaw was identified as unauthenticated and remotely exploitable, and Microsoft issued an emergency out-of-band update on 23 October 2025 after the initial patch on Patch Tuesday failed to fully address it; within hours, active exploitation was observed in the wild.

The threat landscape was underscored by CISA adding CVE-2025-59287 to its Known Exploited Vulnerabilities Catalog on 24 October, highlighting immediate risk for organisations unable to patch promptly. Unit 42 notes that approximately 5,500 WSUS instances were exposed to the internet, with initial access targeting default ports 8530 (HTTP) and 8531 (HTTPS) and execution occurring via PowerShell commands through specific parent processes.

Mitigations proposed include disabling the WSUS Server Role and blocking the two high‑risk ports at the host firewall, with Microsoft guidance to apply the emergency patch once available.