Report · OTX pulseAbout CVE-2025-59287Published 7 Dec 2025Updated 8 Dec 2025

Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild (Updated November 3)

Affects Microsoft WindowsSource AlienVault OTX General

Authoritative record:CVE-2025-59287· Critical 9.8

Exploited in the wild · KEV due 14 Nov 2025 · public exploit available (Metasploit) · 99% EPSS : apply the vendor's fix or mitigations to Microsoft Windows now.

Data as of 25 Oct 2026, 21:29 UTC

CVSS base score

9.8Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 14 Nov 2025 US federal agencies must patch by this date; a sensible deadline for everyone else.
EPSS: 99.9% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 14 Oct 2025
Detectable: evidence found.
nuclei template: Windows Server Update Service - Insecure Deserialization
Weaponised: evidence found.
1 Metasploit module
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 10 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by microsoft
2025-09-1119:36Z, 33 days before disclosure
CVE published
on cve.org
2025-10-1417:01Z, t = 0
In Threat Radar
record ingested
2025-10-1417:17Z, 15 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
2025-10-24, 10 days after disclosure
KEV remediation due
US federal deadline
2025-11-14, 31 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS) affecting versions from Windows Server 2012 through 2025 with the WSUS role enabled. It allows unauthenticated attackers to execute code with system privileges by targeting WSUS instances exposed on ports 8530 and 8531. Initial patches released on October 14, 2025, were incomplete, requiring an emergency update on October 23. Exploitation has been observed shortly after patch release, with attackers using malicious PowerShell commands for reconnaissance and data exfiltration. Approximately 5,500 WSUS instances are exposed globally, posing a significant risk, especially to European organizations. The vulnerability facilitates initial access and lateral movement within networks. Immediate patching and reducing network exposure are critical to mitigate this threat.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with system privileges on affected WSUS servers. This can lead to full compromise of the server, enabling attackers to perform reconnaissance, exfiltrate data, and move laterally within the network. The vulnerability affects critical patch management infrastructure, increasing the risk of widespread network compromise. Approximately 5,500 WSUS instances are exposed globally, increasing the attack surface. European organizations using WSUS are particularly at risk. Active exploitation and public exploit code availability increase the urgency of mitigation.

Mitigation

An official patch was released initially on October 14, 2025, but was incomplete. An emergency update was issued on October 23, 2025, which should be applied immediately to fully remediate the vulnerability. Organizations should verify that WSUS instances are not exposed to untrusted networks on ports 8530 and 8531 and restrict access where possible. Since this is not a cloud service, remediation depends on applying the vendor's patch. Monitor vendor advisories for any further updates. No additional mitigations are specified beyond patching and reducing network exposure.

Summary

CVE-2025-59287 is a remote code execution vulnerability in Microsoft WSUS that affects Windows Server versions from 2012 through 2025 when the WSUS role is enabled. Attackers can exploit exposed WSUS services on ports 8530 and 8531 without authentication to run code with system-level privileges. Initial patching efforts starting October 14, 2025, were insufficient, leading to an emergency patch on October 23. Active exploitation has been confirmed with publicly available Metasploit modules and detection templates. Attackers leverage the vulnerability to execute PowerShell commands for reconnaissance and data theft, enabling initial network access and lateral movement. The vulnerability is listed in the CISA KEV catalog and is actively exploited in the wild.

Metasploit modules

Windows Server Update Service Deserialization Remote Code Executionexploit · Great (opens in a new tab)

Nuclei detection templates

Windows Server Update Service - Insecure Deserializationcritical (opens in a new tab)

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

CWE-502Deserialization of Untrusted Data (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #15OWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Implementation
Explicitly define a final object() to prevent deserialization.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
Software Supply Chain Security (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.2 (opens in a new tab)
V5.5.3 (opens in a new tab)
V5.5.1 (opens in a new tab)
Attack patterns
Object Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

Indicators of compromise

URLs 1

http://webhook.site/22b6b8c8-2e07-4878-a681-b772e569aa6a

CVEs 12

CVE-2024-36401
CVE-2025-21042
CVE-2025-32433
CVE-2025-52905
CVE-2025-52906
CVE-2025-52907
CVE-2025-53868
CVE-2025-55182
CVE-2025-57780
CVE-2025-59287

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Description

AI analysisMachine-generated, updated 25 Oct 2026, 21:29 UTC

Public exploits and detection1 Metasploit module, a Nuclei detection template

WeaknessesCWE-502

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

URLs 1

CVEs 12

Community reviews

Related threats