CRITICAL ALERT: Windows Server WSUS Flaw Actively Exploited (CVE-2025-59287, CVSS 9.8)

Microsoft has issued an emergency security update for enterprise Windows Server Update Services (WSUS) to address CVE-2025-59287, which carries a CVSS of 9.8, with a PoC having been published around 22 October 2025 and exploitation already observed in the wild.

The vulnerability arises from an improper deserialization of untrusted data in WSUS, enabling unauthenticated attackers to execute arbitrary code over the network and potentially gain SYSTEM-level control, though it affects only systems with the WSUS server role enabled.

The Netherlands National Cyber Security Centre (NCSC) reported that exploitation began on 24 October 2025, according to trusted partners, and Eye Security noted that the first observed activity occurred at 06:55 UTC on 24 October when a Base64-encoded payload was deployed to an unnamed client organisation.

Microsoft’s advisory states this is a cumulative update and recommends applying the out-of-band patch and rebooting, with mitigations for systems unable to patch including disabling the WSUS server role and blocking inbound traffic on ports 8530 and 8531. The patch covers several Windows Server releases, including 2012, 2012 R2, 2016, 2019, 2022, 23H2 (Core Installation), and 2025.

In its advisory, Microsoft also emphasised that patches supersede previous updates, and the article notes that exploitation was observed in the wild following the PoC release.