CVE-2025-59287
Published: 14 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-59287 is a critical deserialization of untrusted data vulnerability (CWE-502) in the Windows Server Update Service (WSUS). It enables an unauthorized attacker to execute arbitrary code over a network, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by any unauthorized attacker with network access to a vulnerable WSUS server, requiring no privileges, user interaction, or special conditions. Successful exploitation grants remote code execution (RCE), potentially allowing full compromise of the server with high confidentiality, integrity, and availability impacts.
Microsoft's update guide at msrc.microsoft.com provides patching details, while CISA has ordered federal agencies to patch due to active exploitation in attacks, as reported by BleepingComputer. Vicarius offers detection and mitigation scripts for immediate response.
This flaw has seen real-world exploitation, prompting urgent patching directives from CISA.
Details
- CWE(s)
- KEV Date Added
- 24 October 2025
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CVE-2025-59287 enables remote code execution via deserialization in the public-facing WSUS server without authentication or privileges, directly facilitating T1190: Exploit Public-Facing Application.