Windows Server Update Service (WSUS) Vulnerability

WSUS vulnerability

CVE-2025-59287 Remote Code Execution SYSTEM Privileges

Description

Critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS) allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges on vulnerable servers. Exploitation has been observed in the wild.

Technical Details

The vulnerability is caused by unsafe deserialization of untrusted data in the WSUS reporting web service endpoint. When specially crafted data is sent to this endpoint, it can trigger remote code execution. It affects systems where the WSUS Server Role is enabled and listening on default ports (8530/8531). The flaw enables attackers to run arbitrary code remotely without authentication or user interaction.

Attack Scenario

An attacker identifies a vulnerable WSUS server exposed on the network. By sending a malicious serialized payload to the WSUS reporting service, the attacker exploits the deserialization flaw to gain SYSTEM-level remote code execution. Once compromised, the attacker can use the WSUS server to distribute malicious updates or pivots into the internal network, gaining full control over connected endpoints.

Impact

Full remote compromise of WSUS server
Privilege escalation to SYSTEM
Potential compromise of all systems receiving updates from the infected WSUS server
Service disruption and internal lateral movement

Mitigations

Apply Microsoft's Out-of-Band (OOB) patch released on October 23 2025 immediately.
Disable WSUS Server Role if not essential.
Block inbound traffic on ports 8530/8531 until patched.
Verify no unpatched WSUS servers remain active.
Monitor for unusual WSUS synchronization or update activity.
Reboot after patching.