CVE-2025-59287
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
Description
CVE-2025-59287 is a critical deserialization of untrusted data vulnerability in Windows Server Update Service (WSUS) that allows an unauthorized attacker to execute arbitrary code over the network. With a CVSS v3.1 base score of 9.8 and an EPSS score of 71.4% (98.7th percentile), this vulnerability represents an extremely high risk to organizations running Windows Server. CISA has added CVE-2025-59287 to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 14, 2025, confirming active exploitation in the wild. Affected versions span Windows Server 2012 through Windows Server 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8524 |
| microsoft | windows server 2019 | < 10.0.17763.7922 |
| microsoft | windows server 2022 | < 10.0.20348.4297 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1916 |
| microsoft | windows server 2025 | < 10.0.26100.6905 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287(Vendor Advisory)
- https://hawktrace.com/blog/CVE-2025-59287(Exploit, Third Party Advisory)
- https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/(Press/Media Coverage)
- https://www.vicarius.io/vsociety/posts/cve-2025-59287-detection-script-rce-vulnerability-in-windows-server-update-service(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-59287-mitigation-script-rce-vulnerability-in-windows-server-update-service(Mitigation, Third Party Advisory)
- https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59287(Third Party Advisory, US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CWE-502 describes a vulnerability where an application deserializes data from untrusted sources without sufficient validation, allowing an attacker to inject malicious objects that execute arbitrary code during the deserialization process. In CVE-2025-59287, the Windows Server Update Service improperly deserializes network-supplied data, enabling remote code execution without any authentication. Deserialization vulnerabilities are particularly dangerous because they often provide direct code execution capabilities with the privileges of the affected service.
Impact Analysis
The business impact of CVE-2025-59287 is extremely severe across all three security dimensions. Confidentiality impact is high because successful exploitation grants the attacker code execution on the WSUS server, potentially exposing all managed update data, network topology information, and credentials stored on or accessible from the server. Integrity impact is high as the attacker could manipulate update packages distributed to client systems, enabling supply-chain style attacks across the entire fleet of managed devices. Availability impact is also high, as code execution could be used to disrupt the update infrastructure or deploy destructive payloads.
The EPSS score of 71.4% (98.7th percentile) places this among the most likely-to-be-exploited vulnerabilities currently tracked. WSUS servers are critical infrastructure components in enterprise environments, often serving hundreds or thousands of client machines. Compromising a WSUS server could give an attacker a privileged position to distribute malicious updates to every managed system. The ransomware association is currently listed as unknown, but the strategic value of WSUS servers as distribution points makes them prime targets for ransomware operators seeking maximum organizational impact.
Exploit Maturity
CVE-2025-59287 has been confirmed as actively exploited and is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation due date of November 14, 2025. The EPSS score of 71.4% (98.7th percentile) reflects near-certain exploitation activity. A public exploit analysis and proof-of-concept has been published by HawkTrace, with supporting technical details available on GitHub. Media coverage from BleepingComputer has reported on CISA ordering federal agencies to patch this flaw. The ransomware usage status is currently unknown, but the ability to achieve unauthenticated remote code execution on update infrastructure makes this vulnerability exceptionally attractive to advanced threat actors.
Remediation
- Apply Microsoft security updates immediately. Install the latest cumulative updates for your Windows Server version as documented in the Microsoft Security Response Center advisory. Specific patched builds include Windows Server 2016 (10.0.14393.8524), Windows Server 2019 (10.0.17763.7922), Windows Server 2022 (10.0.20348.4297), Windows Server 2022 23H2 (10.0.25398.1916), and Windows Server 2025 (10.0.26100.6905).
- Restrict network access to the WSUS service. Limit inbound network connectivity to the WSUS server to only authorized client machines and administrative workstations using firewall rules or network segmentation.
- Audit WSUS server logs for indicators of compromise. Review Windows Event Logs and IIS logs on the WSUS server for unusual deserialization errors, unexpected service behavior, or unauthorized access patterns that may indicate prior exploitation.
- Consider deploying detection scripts. Vicarius has published detection and mitigation scripts that can help identify vulnerable systems and apply interim protections while patches are being deployed.
- Plan for Windows Server 2012 end-of-life. Windows Server 2012 and 2012 R2 are affected but may not receive standard patches. Evaluate extended security update options or prioritize migration to a supported server version.
Technical Details
The CVSS v3.1 base score for CVE-2025-59287 is 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack Vector (AV:N) confirms the vulnerability is exploitable remotely over the network. Attack Complexity (AC:L) indicates no special conditions are required for exploitation. Privileges Required (PR:N) means no authentication is needed, and User Interaction (UI:N) confirms no victim action is required. Scope (S:U) is unchanged. All three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated high, reflecting complete system compromise potential.
The attack mechanism targets the deserialization logic within Windows Server Update Service. An attacker sends specially crafted serialized objects to the WSUS service over the network. Because the service fails to properly validate and sanitize the incoming serialized data before processing it, the attacker can inject malicious objects that execute arbitrary code in the context of the WSUS service. This grants the attacker the same privileges as the WSUS service account, which typically runs with elevated permissions. The combination of network accessibility, no authentication requirement, and full impact across confidentiality, integrity, and availability makes this one of the most critical WSUS vulnerabilities discovered.
Frequently Asked Questions
What is CVE-2025-59287?
CVE-2025-59287 is a critical remote code execution vulnerability in Windows Server Update Service (WSUS) caused by deserialization of untrusted data. It allows an unauthenticated attacker to execute arbitrary code on affected Windows Server systems over the network, with a CVSS score of 9.8.
Which Windows Server versions are affected by CVE-2025-59287?
All Windows Server versions from 2012 through Windows Server 2025 are affected. This includes Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025. Each version has specific patched build numbers that should be applied.
Is CVE-2025-59287 being used in ransomware attacks?
The ransomware association is currently listed as unknown by CISA. However, given the unauthenticated remote code execution capability and the strategic position of WSUS servers in enterprise networks, the vulnerability presents a high-value target for ransomware operators seeking to maximize impact across managed systems.
How urgent is patching CVE-2025-59287?
Patching is extremely urgent. CISA has set a remediation deadline of November 14, 2025, and the EPSS score of 71.4% places it in the 98.7th percentile for exploitation probability. Active exploitation has been confirmed, and public exploit code is available.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.