Threats Tagged 'patch management'

A critical remote code execution vulnerability (CVE-2025-59287) exists in Microsoft Windows Server Update Services (WSUS) affecting versions from Windows Server 2012 through 2025 with the WSUS role enabled. This flaw allows unauthenticated attackers to execute code with system privileges by targeting exposed WSUS instances on ports 8530 and 8531. Initial patching on October 14, 2025, was incomplete, necessitating an emergency update on October 23. Exploitation has been observed within hours of patch release, with attackers leveraging malicious PowerShell commands for reconnaissance and data exfiltration. Approximately 5,500 WSUS instances are exposed globally, representing a significant attack surface. The vulnerability facilitates initial access and lateral movement within networks. European organizations using WSUS for patch management are at risk of compromise, data theft, and broader network infiltration. Immediate patching and network exposure reduction are critical to mitigate this threat.

MediumCampaignGermanyFranceItaly+7#patch management#active exploitation#cisa

This intelligence report emphasizes the importance of understanding one's own environment and personal weaknesses in cybersecurity. It stresses the need for repeatable processes to maintain knowledge of one's environment and advocates for continuous learning to fill skill gaps. The report also highlights recent vulnerability disclosures by Cisco Talos across various software, including catdoc, Parallel, NVIDIA, and High-Logic FontCreator. It underscores the significance of promptly applying patches and remaining vigilant against potential exploits. Additionally, the report touches on recent cyber incidents affecting the NHS, United Natural Foods, and vulnerabilities in Google accounts and SinoTrack GPS devices.

MediumMalwareUnited KingdomGermanyFrance+7#critical infrastructure#ransomware#patch management