CVE-2025-59287: Microsoft WSUS deserialization flaw allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated network RCE, KEV listing with a federal remediation deadline, and near-maximum EPSS make this an urgent patch-first item.

What it is

Windows Server Update Service (WSUS) deserializes untrusted data, letting an unauthenticated network attacker run code on the server. The flaw is rated CVSS 9.8 critical and affects WSUS on Windows Server 2012 through 2025. Because WSUS is a central patch-distribution role, compromise of that host can affect the whole managed estate.

Impact

An attacker gains remote code execution on the WSUS server with no credentials, giving full control of the host (high confidentiality, integrity and availability impact). From there they can tamper with updates distributed to managed endpoints.

Attack surface

Reachable over the network (AV:N) with no privileges and no user interaction (PR:N, UI:N), so any host that can reach the WSUS service can attempt it. No authentication is required per the vector and description.

Exploitation

CISA added it to KEV on 2025-10-24 with a 2025-11-14 remediation due date, and references include an exploit write-up and press reporting of attacks in the wild. EPSS is 0.9998 (99.98th percentile), indicating very high predicted exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2025-59287 to all WSUS servers immediately, per the vendor advisory.
• If patching is not immediately possible, follow the vendor and CISA BOD 22-01 guidance, including discontinuing or isolating the WSUS role where mitigations are unavailable.
• Restrict network access to WSUS ports (8530/8531) to only required management and client hosts.
• Review WSUS server exposure and remove internet-facing or unnecessary instances.
• Monitor for post-exploitation changes to WSUS configuration, approvals and update content.

Detection

• Hunt for unexpected processes or child processes spawned by the WSUS service (w3wp.exe or wsusservice.exe).
• Monitor WSUS server logs and IIS logs for anomalous requests to the WSUS API endpoints.
• Alert on unexpected outbound connections or new services/accounts on WSUS hosts.
• Audit WSUS update approvals and content changes for tampering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.