Critical Vulnerability in Windows Server Update Services Under Active Exploitation

A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-59287, has been identified in Microsoft’s Windows Server Update Services (WSUS). This flaw, which has a CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary code with system-level privileges on vulnerable servers. The vulnerability arises from the unsafe deserialization of untrusted data, specifically within the GetCookie() endpoint of WSUS, which is used to manage and distribute Windows updates across organizational networks.

Critical WSUS RCE flaw targeted by attackers after patchCISA Warns of Hackers Exploiting Windows Server RCE FlawCritical Windows Server Flaw Exploited by HackersCISA Alerts on Active Exploitation of Windows Server Update Services RCE FlawHackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed OnlineAct now! ACSC warns of critical Microsoft Windows Server Update Service vulnerability

• October 14, 2025: Information about CVE-2025-59287 is first published.

Critical Dell Storage Manager Vulnerabilities Let Attackers Compromise System

• October 21, 2025: A proof-of-concept (PoC) exploit is released by Hawktrace.

Critical WSUS RCE flaw targeted by attackers after patch

• October 23, 2025: Microsoft issues an out-of-band security update to address the vulnerability.

Act now! ACSC warns of critical Microsoft Windows Server Update Service vulnerability

• October 24, 2025: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation.

CISA Warns of Hackers Exploiting Windows Server RCE Flaw

Following the release of the patch, attackers began targeting WSUS instances exposed on ports 8530 and 8531. Huntress reported that these attackers utilized crafted POST requests to exploit the deserialization flaw, allowing them to execute malicious commands and extract sensitive data from compromised servers. As of October 27, 2025, approximately 2,800 WSUS instances were identified as exposed online, primarily in North America and Europe.

Critical WSUS RCE flaw targeted by attackers after patchCritical Windows Server Flaw Exploited by HackersHackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed OnlineCISA Alerts on Active Exploitation of Windows Server Update Services RCE FlawCISA Warns of Hackers Exploiting Windows Server RCE Flaw

Microsoft has urged organizations to apply the October 23 security update immediately. For those unable to patch right away, it is advised to block inbound traffic to ports 8530 and 8531, which will temporarily disable WSUS but prevent exploitation. The patch is applicable to various Windows Server versions, including 2012, 2016, 2019, 2022, and 2025. Organizations are also encouraged to conduct audits of their WSUS configurations to ensure that only necessary ports are accessible.

Critical WSUS RCE flaw targeted by attackers after patchCISA Alerts on Active Exploitation of Windows Server Update Services RCE FlawCritical Windows Server Flaw Exploited by HackersCISA Warns of Hackers Exploiting Windows Server RCE FlawHackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed Online

Experts have criticized the delay in patch adoption, noting that as of late October, only 40% of scanned instances showed signs of mitigation. Benjamin Harris, CEO of cybersecurity firm watchTowr, emphasized that organizations with exposed WSUS instances likely faced immediate risks, stating, “If an unpatched WSUS instance is online, at this stage it has likely already been compromised.” This highlights the urgency for organizations to prioritize patching and secure their systems against potential breaches.

Hackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed Online

• “Attackers are exploiting this in real time. Systems should be patched or taken offline until they are secured,” — Huntress

Critical Windows Server Flaw Exploited by Hackers

• “This isn’t just a patch issue; it’s a reminder to audit update servers regularly,” — Elena Vasquez, Cybersecurity Analyst

Hackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed Online

• “We’ve observed exposure in 8,000+ instances, including extremely sensitive, high-value organisations.” — Benjamin Harris, CEO of watchTowr

Act now! ACSC warns of critical Microsoft Windows Server Update Service vulnerability

Organizations are advised to monitor their WSUS deployments closely and implement the necessary updates as soon as possible. CISA has mandated that federal agencies must patch affected systems by November 14, 2025. Continuous monitoring for anomalous traffic and unauthorized access attempts is also recommended to mitigate further risks associated with this vulnerability.

CISA Alerts on Active Exploitation of Windows Server Update Services RCE Flaw