wsus remote code execution needed a second, out-of-band patch
Microsoft released an out-of-band update for a critical Windows Server Update Services flaw after an earlier update did not fully mitigate it, and CISA added it to its known-exploited catalog the next day.
- cve
- CVE-2025-59287
- cvss
- 9.8 (v3.1, Microsoft)
- affected
- Windows Server 2012, 2016, 2019, 2022, 2025 with the WSUS Server Role enabled
- fixed in
- out-of-band update of 2025-10-23 (hotpatch update 2025-10-24)
- exploited
- yes — added to CISA KEV 2025-10-24
- platforms
- Windows Server (WSUS role)
what happened
- CVE-2025-59287 is a deserialization-of-untrusted-data flaw in Windows Server Update Service first published on 2025-10-14; on 2025-10-23 Microsoft released an out-of-band update to comprehensively address it.[1,3]
- CISA said the prior update did not fully mitigate the flaw, which could give an unauthenticated attacker remote code execution with SYSTEM-level privileges on Windows Server 2012, 2016, 2019, 2022 and 2025.[2]
- Microsoft scored it 9.8 under CVSS v3.1.[1,3]
- WSUS listens on TCP 8530 and 8531 by default, and Microsoft says servers without the WSUS Server Role enabled are not vulnerable.[2,1]
- Hotpatch-enrolled Windows Server 2022 and 2025 machines received a standalone update on 2025-10-24.[1]
- CISA added CVE-2025-59287 to its KEV catalog on 2025-10-24 with a 2025-11-14 due date.[4,2]
- CISA advised watching for SYSTEM-level child processes spawned by wsusservice.exe or w3wp.exe and nested PowerShell with base64-encoded commands.[2]
where sources differMicrosoft's Security Update Guide record shows the exploited flag as "No", while CISA lists the CVE as known exploited from 2025-10-24. The CVE was first published 2025-10-14 (before this window); the out-of-band patch and KEV listing fall inside it.
sources4
- 01CVE-2025-59287: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability (Security Update Guide API) ↗ primaryMicrosoft Security Response Centeraccessed 2026-10-21
- 02Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287 ↗ primaryCISAaccessed 2026-10-21
- 03NVD CVE API record for CVE-2025-59287 ↗ primaryNIST NVDaccessed 2026-10-21
- 04CISA Catalog of Known Exploited Vulnerabilities (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21