Microsoft Windows Server Update Services (WSUS), deserialization RCE

Overview

CVE-2025-59287 is a critical, unauthenticated remote code execution vulnerability in Windows Server Update Services (WSUS). An attacker can send a crafted event to an exposed WSUS server and trigger unsafe deserialization, executing code as SYSTEM with no authentication and no user interaction. Because WSUS is the trusted distribution point for Windows updates inside an organization, compromise is especially dangerous. Microsoft shipped an emergency out-of-band update on October 23, 2025 after the original Patch Tuesday fix proved incomplete, and mass exploitation began within hours.

Technical Details

The vulnerability lies in how the WSUS service deserializes attacker-controlled objects received over its reporting/event channel (default ports 8530/8531). Insufficient validation allows a malicious serialized payload to instantiate dangerous .NET gadget chains, yielding command execution in the WSUS service context (SYSTEM). Only servers with the WSUS Server Role enabled are affected; the role is not installed by default, but is common on management and patching infrastructure.

Impact

• Unauthenticated SYSTEM-level RCE on the patch-management server.
• Supply-chain leverage inside the org: control of WSUS can influence which updates clients receive.
• Broad blast radius: WSUS typically has network reach to most managed endpoints and servers.
• Confirmed in-the-wild exploitation drove the CISA KEV listing and an out-of-band advisory.

Mitigation

1. Install the October 23, 2025 out-of-band update for your Windows Server build (e.g. 2025: 10.0.26100.6905, 2022: 10.0.20348.4297, 2019: 10.0.17763.7922), then reboot - the fix is not fully applied until restart.
2. Temporary workaround if you cannot patch: disable the WSUS Server Role, or block inbound traffic to ports 8530/8531 at the host firewall (clients will not receive updates while blocked).
3. Do not expose WSUS to the internet; restrict it to the management network.
4. Hunt for post-exploitation activity on WSUS servers patched late.

Detection

• Inspect w3wp.exe (WSUS app pool) for spawning cmd.exe / powershell.exe child processes.
• Review WSUS and IIS logs for anomalous requests to the reporting web service.
• Correlate with CISA KEV (added October 24, 2025) indicators and any unexpected processes running as SYSTEM.