CISA Beware! Hackers Are Actively Exploiting Windows Server Update Services RCE Flaw in the Wild

According to Eye Security, hackers are actively exploiting a deserialization vulnerability in Microsoft Windows Server Update Services (WSUS) tracked as CVE-2025-59287, with unauthenticated attackers able to run arbitrary code on vulnerable servers. The activity appears to be conducted manually, with evidence including the execution of whoami.exe by the w3wp.exe process, a sign of a malicious web shell, and a series of spaced commands suggesting a hands-on approach.

The attack utilised a base64 encoded payload containing a .NET executable that allows commands to be executed via an HTTP request header, giving the attacker control over the compromised server. WSUS servers are central to deploying updates across organisations, and a scan of the internet found around 8,000 WSUS servers with ports 8530 or 8531 exposed, though it is not yet clear how many are vulnerable.

Microsoft has released an out-of-band patch, KB5070883, to address CVE-2025-59287, and security experts urge applying it promptly while ensuring WSUS servers are not publicly reachable and that EDR solutions monitor for suspicious activity.