Microsoft issues out-of-band WSUS patch for CVE-2025-59287 RCE

Microsoft issued emergency out-of-band updates on Thursday to fix a critical remote code execution vulnerability in Windows Server Update Services, and security researchers reported attacks using the flaw within hours. The vulnerability, tracked as CVE-2025-59287, affects WSUS installations on Windows Server 2012, 2012 R2, 2016, 2019, 2022 (including 23H2 and Server Core) and Windows Server 2025. Researchers and national authorities said some WSUS instances exposed to the public internet were targeted soon after proof-of-concept code became available.

Microsoft said the flaw stems from unsafe deserialization in a legacy serialization mechanism used by WSUS that allows an unauthenticated remote attacker to send crafted data and achieve remote code execution with SYSTEM privileges. The company acknowledged that an update issued on October 14 did not fully mitigate the issue and released the cumulative out-of-band fixes on October 23. A Microsoft spokesperson said, "We rereleased this CVE after identifying that the initial update did not fully mitigate the issue. Customers who have installed the latest updates are already protected."

Researchers reported multiple exploitation...