Microsoft Issues Emergency Patch for Critical Windows Server Bug

Microsoft has issued a second, out-of-band update to comprehensively address CVE-2025-59287, a remote code execution flaw in Windows Server Update Services (WSUS) that is under attack in the wild. The vulnerability, which carries a 9.8 CVSS score, allows attackers to trigger unsafe object deserialization and remotely execute code on vulnerable systems, according to Microsoft's advisory.

Microsoft initially fixed CVE-2025-59287 in the October Patch Tuesday, but the company says the initial patch was incomplete and customers who have installed the latest updates are already protected.

Exploitation activity has been observed, with several cybersecurity firms warning that attacks are underway; Horizon3 researchers said they expect more attacker activity for this vulnerability to hit CISA KEV very soon, and Huntress researchers reported exploitation beginning on Thursday against WSUS instances exposed on ports 8530 and 8531.

Hawktrace published a technical analysis of the flaw, noting the vulnerability stems from AuthorizationCookie objects deserialized by BinaryFormatter, and Microsoft advised that disabling the WSUS Server Role or blocking inbound traffic on ports 8530 and 8531 can be temporary mitigations. According to Microsoft’s advisory, the WSUS Server Role must be enabled for the vulnerability to be exploited.