Microsoft WSUS Remote Code Execution (CVE-2025-59287)

Historical catalog analysis: CISA added this entry on October 24, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-59287 is a vulnerability in the Microsoft Windows Server Update Service (WSUS) involving the deserialization of untrusted data (CWE-502). This flaw allows an attacker to achieve remote code execution (RCE) on the affected system. The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 24, 2025.

Exposure and applicability

This vulnerability applies to environments deploying Microsoft WSUS for centralized update management. Because WSUS typically resides in a privileged position within the infrastructure to distribute updates to numerous endpoints, an RCE flaw in this service represents a significant exposure path. Organizations should identify all active WSUS instances across their server estate to determine the scope of applicability.

Remediation priorities

Based on its inclusion in the CISA KEV catalog, remediation should be prioritized as a high-urgency task. Our analysis suggests the following priority sequence:

1. Vendor Mitigation: Apply the official mitigations provided by Microsoft via the MSRC update guide.
2. Cloud Service Review: For organizations utilizing WSUS within cloud environments, follow applicable BOD 22-01 guidance to ensure service provider mitigations are active.
3. Decommissioning: If vendor mitigations cannot be applied or are unavailable for a specific legacy configuration, the product should be discontinued to eliminate the attack surface.

How to validate remediation

Verification must move beyond simple version checks, as a deployed patch does not always guarantee that the vulnerability is neutralized in the running environment. To verify that exposure has been reduced, defenders should:

• Confirm Patch Application: Verify through system logs or update management consoles that the specific security update addressing CVE-2025-59287 is successfully installed.
• Service Validation: Ensure the WSUS service has been restarted following the update to ensure the patched binaries are loaded into memory.
• Configuration Audit: Review network access controls to ensure only authorized clients can communicate with the WSUS server, reducing the potential for untrusted data to reach the deserialization point.

Limits and open questions

While the vulnerability is confirmed as exploited in the wild per CISA, it remains unknown whether this flaw has been utilized specifically by ransomware campaigns. Additionally, while federal agencies have a mandated deadline of November 14, 2025, non-federal organizations must determine their own risk tolerance based on their specific exposure. Residual risk remains if the WSUS server is exposed to untrusted networks or if legacy dependencies prevent the application of current vendor mitigations.

Source and editorial note

CVE-2025-59287: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability · Source date: October 24, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: October 27, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 30, 2026 at 00:16 UTC.

Request a Vulnerability Assessment