Hackers Actively Scanning TCP Ports 8530/8531 for WSUS CVE-2025-59287

Security researchers at the SANS Internet Storm Center have detected a significant spike in suspicious network traffic targeting Windows Server Update Services (WSUS) infrastructure worldwide. The reconnaissance activity focuses specifically on TCP ports 8530 and 8531, which correspond to unencrypted and encrypted communication channels for WSUS servers vulnerable to CVE-2025-59287.

This coordinated scanning campaign suggests threat actors are actively seeking exposed systems they can compromise, with the vulnerability described as critical for WSUS servers. Attackers can connect via port 8530 for HTTP or port 8531 for HTTPS, potentially enabling arbitrary scripts and broad control over the affected server and the wider network it manages.

Data from multiple firewall sensors confirms the escalation in scanning throughout the previous week, with some activity originating from known security research sources but other IPs appearing unrelated to legitimate testing. Organisations should identify whether their WSUS deployments run vulnerable versions, patch immediately where possible, and implement segmentation or restricted access to mitigate the immediate threat, according to the SANS Internet Storm Center. 3 November 2025.