Microsoft Issues Emergency Update for Critical Windows Server Vulnerability

On October 23, 2025, Microsoft released an emergency out-of-band security update addressing a critical vulnerability in the Windows Server Update Services (WSUS), tracked as CVE-2025-59287. This vulnerability, which has a CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges, posing a significant threat to organizations using WSUS for centralized update management. The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attacks exploiting this vulnerability are already underway.

Critical RCE exploit in Microsoft WSUS actively exploited. CISA warns: imminent riskForbesHackers Exploit Windows Server Flaw Hours After Emergency PatchMicrosoft pushes emergency patch for WSUS 0dayForbes

CISA issued a global alert on October 25, 2025, warning organizations of the active exploitation of CVE-2025-59287. Researchers from Huntress Labs and Eye Security reported that attacks began shortly after the emergency patch was released, with threat actors targeting WSUS servers exposed on default ports 8530 and 8531. The vulnerability stems from unsafe deserialization of AuthorizationCookie data, allowing attackers to send malicious requests that can compromise the server.

Hackers Exploit Windows Server Flaw Hours After Emergency PatchCritical RCE exploit in Microsoft WSUS actively exploited. CISA warns: imminent riskForbesMicrosoft pushes emergency patch for WSUS 0dayForbes

CISA has mandated that federal agencies mitigate this vulnerability by November 14, 2025. Organizations are advised to:

Critical RCE exploit in Microsoft WSUS actively exploited. CISA warns: imminent risk

1. Identify servers with the WSUS role enabled and ports 8530 and 8531 open.

Microsoft pushes emergency patch for WSUS 0day

2. Apply the October 23 out-of-band patch and reboot the servers to ensure full mitigation.

Forbes

3. If immediate patching is not possible, disable the WSUS role or block inbound traffic to the affected ports at the host firewall level.

Microsoft pushes emergency patch for WSUS 0dayCritical RCE exploit in Microsoft WSUS actively exploited. CISA warns: imminent riskHackers Exploit Windows Server Flaw Hours After Emergency PatchForbesForbes

Microsoft emphasized that these workarounds should not be reversed until the update is installed.

Forbes

Despite the urgency of the situation, some experts have raised concerns about the adequacy of Microsoft's initial response. The vulnerability's exploitation potential and the rapid pace of attacks suggest that organizations may not be fully prepared to handle the threat. Piet Kerkhofs, CTO of Eye Security, noted that the sophistication of the attacks indicates involvement from advanced threat actors, potentially including state-sponsored groups.

Hackers Exploit Windows Server Flaw Hours After Emergency Patch

CISA has strongly urged all organizations to implement the updated guidance for the WSUS vulnerability, warning of the risks associated with delayed action. Microsoft reiterated the importance of applying the update promptly to prevent unauthorized access and potential system takeovers.

Critical RCE exploit in Microsoft WSUS actively exploited. CISA warns: imminent risk

• “strongly urges organizations to implement Microsoft’s updated Windows Server Update Service Remote Code Execution Vulnerability guidance, or risk an unauthenticated actor achieving remote code execution with system privileges.” — CISA

Forbes

• “We can reproduce the RCE and it feels like it's complex enough to be a state actor or advanced ransomware gang that has weaponized the CVE in only a few days.” — Piet Kerkhofs, CTO of Eye Security

Hackers Exploit Windows Server Flaw Hours After Emergency Patch

• “Microsoft said: "If you are unable to install the October 23, 2025 out-of-band update, you can take any of the following actions to be protected against this vulnerability: If the WSUS Server Role is enabled on your server, disable it.” — Microsoft

Microsoft pushes emergency patch for WSUS 0day

The emergence of CVE-2025-59287 highlights the critical need for organizations to remain vigilant and responsive to cybersecurity threats. With active exploitation already reported, immediate action is essential to safeguard IT infrastructures from potential breaches.

Critical RCE exploit in Microsoft WSUS actively exploited. CISA warns: imminent risk