CISA Alerts on Active Exploitation of WSUS Vulnerability

According to CISA, the Cybersecurity and Infrastructure Security Agency, there is active exploitation of a critical vulnerability affecting Windows Server Update Service (WSUS), now addressed by an out-of-band update. The flaw, CVE-2025-59287, is a remote code execution vulnerability impacting WSUS across multiple Windows Server versions including 2012, 2016, 2019, 2022, and 2025, and emerged after a previous patch failed to fully resolve the issue.

CISA added CVE-2025-59287 to its Known Exploited Vulnerabilities Catalog on 24 October 2025, confirming active exploitation in the wild, and agencies are urged to apply the update released on 23 October 2025 to identified servers. The first step for organisations is identifying vulnerable servers by checking if the WSUS Server Role is enabled and whether ports TCP 8530 or TCP 8531 are open, with verification possible via a PowerShell command or the Server Manager Dashboard.

After patching, a reboot is required to complete mitigation, and if immediate deployment is not possible, disabling the WSUS Server Role or blocking inbound traffic to the default WSUS listener ports is advised. Security teams should monitor for suspicious activity and nested PowerShell processes, particularly those from wsusservice.exe or w3wp.exe, and ensure endpoint security alerts for unusual privilege-escalation and process behaviour.