Attackers Exploit Windows Server Update Services Flaw to Steal Sensitive Organizational Data

Sophos researchers have identified real‑world exploitation of a newly disclosed vulnerability in Windows Server Update Services (WSUS), tracked as CVE-2025-59287, which is being used to harvest sensitive organisational data. According to Sophos, patches were released by Microsoft on 14 October 2025, followed by an emergency out‑of‑band update on 23 October, and the publication of PoCs on GitHub accelerated the attacks.

The first abuse of the flaw was detected on 24 October at 02:53 UTC, triggering a coordinated wave of attacks against internet‑facing WSUS servers across multiple industries, with victims reportedly spanning technology, healthcare, manufacturing and education sectors, largely in the United States.

The attackers exploit a deserialization bug to run Base64‑encoded PowerShell commands via nested cmd.exe processes in IIS worker processes, harvesting data such as external IP addresses, port configurations, domain user lists, and network interface details before exfiltrating to external webhook[.]site URLs under the threat actors’ control; when webhook[.]site uploads fail, curl is used as a fallback.

Security experts and government bodies, including CISA and NSA, urge immediate patching and network segmentation to mitigate the rapid exploitation observed since 24 October.