All vulnerabilities
CVE-2025-59287

Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Microsoft WindowsOperating systems
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 24 Oct 2025CISA KEV
Exploit odds (EPSS)>99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.2.9200.25728Also 6.3.9600.22826, 10.0.14393.8524 and 4 moreCVE List
Federal deadline14 Nov 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 6.2.9200.25728Windows Server 2012CVE List
  • 6.2.9200.25728Windows Server 2012 (Server Core installation)CVE List
  • 6.3.9600.22826Windows Server 2012 R2CVE List
  • 6.3.9600.22826Windows Server 2012 R2 (Server Core installation)CVE List
  • 10.0.14393.8524Windows Server 2016CVE List
  • 10.0.14393.8524Windows Server 2016 (Server Core installation)CVE List
Show all 12 fixed versions
  • 10.0.17763.7922Windows Server 2019CVE List
  • 10.0.17763.7922Windows Server 2019 (Server Core installation)CVE List
  • 10.0.20348.4297Windows Server 2022CVE List
  • 10.0.25398.1916Windows Server 2022, 23H2 Edition (Server Core installation)CVE List
  • 10.0.26100.6905Windows Server 2025CVE List
  • 10.0.26100.6905Windows Server 2025 (Server Core installation)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 14 Oct 2025Exploit code publicMetasploit
  2. 14 Oct 2025, 17:01 UTCPublishedCVE List
  3. 24 Oct 2025Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Exploit moduleWindows Server Update Service Deserialization Remote Code Execution 14 Oct 2025Metasploit
  • Scanner templateWindows Server Update Service - Insecure DeserializationNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.

Text from CVE List

Affected versions 12

  • Windows Server 2012affected: 6.2.9200.0 before 6.2.9200.25728CVE List
  • Windows Server 2012 (Server Core installation)affected: 6.2.9200.0 before 6.2.9200.25728CVE List
  • Windows Server 2012 R2affected: 6.3.9600.0 before 6.3.9600.22826CVE List
  • Windows Server 2012 R2 (Server Core installation)affected: 6.3.9600.0 before 6.3.9600.22826CVE List
  • Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.8524CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.8524CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.7922CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.7922CVE List
  • Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.4297CVE List
  • Windows Server 2022, 23H2 Edition (Server Core installation)affected: 10.0.25398.0 before 10.0.25398.1916CVE List
  • Windows Server 2025affected: 10.0.26100.0 before 10.0.26100.6905CVE List
  • Windows Server 2025 (Server Core installation)affected: 10.0.26100.0 before 10.0.26100.6905CVE List

References 9