9.8

CVE-2025-59287

Warning
Media report
Exploit

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Windows Server 2016 Version < 10.0.14393.8524
Microsoft ≫ Windows Server 2019 Version < 10.0.17763.7922
Microsoft ≫ Windows Server 2022 Version < 10.0.20348.4297
Microsoft ≫ Windows Server 2022 23h2 Version < 10.0.25398.1916
Microsoft ≫ Windows Server 2025 Version < 10.0.26100.6905
VulnDex Vulnerability Enrichment
This information is available to logged-in users. Login Login

24.10.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Vulnerability

Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.

Description

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Required actions
EPSS Metrics
Type Source Score Percentile
EPSS FIRST.org 99.94% 1
CVSS Metrics
Source Base Score Exploit Score Impact Score Vector string
Microsoft 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

A VulnDex account is required to access Vulnerability Intelligence.
VulnDex Intel
Media Report
25.10.2025 09:15
A VulnDex account is required to access Vulnerability Intelligence.
VulnDex Intel
Media Report
24.10.2025 08:30
A VulnDex account is required to access Vulnerability Intelligence.
VulnDex Intel
Media Report
15.10.2025 09:43
A VulnDex account is required to access Vulnerability Intelligence.
VulnDex Intel
Media Report
15.10.2025 01:13
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
Vendor Advisory
https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59287
Third Party Advisory
US Government Resource
https://hawktrace.com/blog/CVE-2025-59287
Third Party Advisory
Exploit
https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/
Press/Media Coverage
https://www.vicarius.io/vsociety/posts/cve-2025-59287-detection-script-rce-vulnerability-in-windows-server-update-service
Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-59287-mitigation-script-rce-vulnerability-in-windows-server-update-service
Third Party Advisory
Mitigation