CVE-2025-59287

The WSUS service incorrectly processes untrusted data during deserialization (CWE-502). An attacker can send a crafted network payload that is deserialized by the vulnerable service without prior authentication. This results in arbitrary code execution in the context of the attacked server.

An unauthenticated attacker can remotely gain full control of the server — access confidential data, modify systems, or disrupt their operation (complete breach of confidentiality, integrity, and availability).

Apply patches available from the vendor according to the references (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287). CISA mandated immediate patch deployment for U.S. federal agencies. Until updates are applied, it is recommended to restrict network access to WSUS interfaces to trusted hosts only.

Microsoft Windows Server 2012, Windows Server 2016, Windows Server 2022, Windows Server 2022 23H2, Windows Server 2025 — with the Windows Server Update Service (WSUS) role running.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.