Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild (Updated November 3)
Summary: On Oct. 14, 2025, a critical unauthenticated remote code execution vulnerability was identified in Microsoft's Windows Server Update Services (WSUS), and Microsoft's initial October Patch Tuesday fix did not fully address it, requiring an emergency out-of-band update on Oct. 23, 2025. Within hours of that emergency update, Unit 42 and other researchers observed active exploitation in the wild, with attacks using unsafe deserialization via the GetCookie() endpoint and the ReportingWebService to execute code at the highest system privileges.
Why it matters: Cortex Xpanse identified roughly 5,500 WSUS instances exposed to the internet, and a compromised WSUS server - the trusted source for your patches - can become a foothold for lateral movement and enterprise-wide compromise.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-59287
- Related
- CVE-2025-59287: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Oct 24, 2025