Microsoft Releases Out-of-Band Security Update for Windows Server Update Service (WSUS)
CVE-2025-59287 is under active exploitation and could lead to unauthenticated remote code execution over a network
Summary
CVE-2025-59287 is under active exploitation and could lead to unauthenticated remote code execution over a network
Affected platforms
The following platforms are known to be affected:
Threat details
Exploitation of CVE-2025-59287
CVE-2025-59287 has been added to the US Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities Catalog (KEV), and further exploitation has been reported in the wild. Additionally a public proof-of-concept (PoC) exploit has been released by security researchers and the NHS England National CSOC is aware of reports that cyber criminals have weaponised the PoC.
The National CSOC assesses further exploitation as highly likely.
Introduction
Microsoft has released an out-of-band security update to address a critical vulnerability in the Windows Server Update Service (WSUS).
-
CVE-2025-59287 is a "Deserialisation of Untrusted Data" vulnerability with a CVSSv3 score of 9.8. Successful exploitation could allow a remote, unauthenticated attacker to perform remote code execution (RCE) over a network.
Threat updates
| Date | Update |
|---|---|
| 27 Oct 2025 | Added Windows Server 2019 to affected platforms |
| 27 Oct 2025 |
Severity changed to High
The following items have been updated to reflect this change:
|
Remediation advice
Affected organisations must review Microsoft's security advisory and follow the remediation steps detailed below.
Remediation steps
| Type | Step |
|---|---|
| Patch |
Required: Organisations must install the out-of-band security update released on October 23, 2025 as soon as possible. Microsoft has advised that organisations must reboot the affected system after applying the relevant security update. Organisations enrolled in the Windows Server "hotpatch" programme will also need to reboot after the security update is applied if the affected system has Windows Server Update Service (WSUS) enabled. https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-59287 |
| Action |
Recommended: Organisations are strongly encouraged to follow Microsoft's guidance to limit access to Windows Server Update Service (WSUS) over the internet. https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-59287 |
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 27 October 2025 2:37 pm