CISA and NSA Issue Urgent Guidance to Secure WSUS and Microsoft Exchange Servers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), with international partners from Australia and Canada, have issued guidance to harden on-premise Microsoft Exchange Server instances from potential exploitation, according to CISA. The guidance emphasises restricting administrative access, implementing multi-factor authentication, enforcing strict transport security configurations, and adopting zero-trust security model principles to bolster defenses.

It also notes that malicious activity aimed at Exchange Server continues, and organisations are advised to decommission end-of-life on-premises or hybrid Exchange servers after transitioning to Microsoft 365. The publication accompanies a CVE-2025-59287 update to its alert, and urges organisations to identify susceptible servers, apply the out-of-band Microsoft security update, and monitor for signs of threat activity, including suspicious SYSTEM-level processes and nested PowerShell activity.

The report follows Sophos findings that threat actors are exploiting WSUS to harvest data, with activity first detected on 24 October 2025, and details an alternate attack chain involving mmc.exe triggering cmd.exe when accessing WSUS Admin Console.