Critical WSUS Flaw (CVE-2025-59287, CVSS 9.8) Allows Unauthenticated RCE via Unsafe Cookie Deserialization, PoC Available

SecurityOnline[.]info reports a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287 with a CVSS of 9.8, enabling unauthenticated attackers to execute arbitrary code with SYSTEM privileges. The flaw stems from unsafe deserialization of AuthorizationCookie data at the GetCookie() endpoint, where encrypted cookie data is decrypted with AES-128-CBC and deserialized via BinaryFormatter without proper type validation.

A security researcher, Batuhan Er from HawkTrace, published a proof-of-concept PoC on GitHub showing how a crafted AuthorizationCookie can trigger RCE, effectively bypassing authentication on vulnerable WSUS installations. Microsoft patched the vulnerability in its October 2025 Patch Tuesday update. The article emphasises the risk posed by deserialisation of untrusted data in WSUS’s internal flow and its potential impact across enterprise networks.