Search/CVE-2025-59287
● CVE — Critical

CVE-2025-59287

VendormicrosoftProductwindows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, windows server 2022 23h2DiscoveredOct 14, 2025UpdatedNov 12, 2025

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
99.9%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
13
sources referencing this CVE
Related IOCs
3
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 15, 2026
▲ 0.04pp
99.9% → 99.9% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
21 relationships
Timeline
disclosure → media coverage
Oct 14, 2025
Disclosure — published as a CVE record. · last revised by NVD Nov 12, 2025
Oct 14, 2025
advisories.ncsc.nl reports: NCSC-2025-0310 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Windows
Oct 24, 2025
helpnetsecurity.com reports: Microsoft releases urgent fix for actively exploited WSUS vulnerability (CVE-2025-59287)
Oct 24, 2025
securityweek.com reports: Critical Windows Server WSUS Vulnerability Exploited in the Wild
Oct 24, 2025
thehackernews.com reports: Newly Patched Critical Microsoft WSUS Flaw Comes Under Active Exploitation
Oct 25, 2025
acn.gov.it reports: Microsoft: rilevato sfruttamento in rete della CVE-2025-59287
Oct 27, 2025
unit42.paloaltonetworks.com reports: Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild
Oct 27, 2025
go.theregister.com reports: WSUS attacks hit 'multiple' orgs as Google and other infosec sleuths ring Redmond’s alarm bell
Oct 28, 2025
infosecurity-magazine.com reports: Actively Exploited WSUS Bug Added to CISA KEV List
Oct 29, 2025
redhotcyber.com reports: Tasting the Exploit: HackerHood testa l’Exploit di Microsoft WSUS CVE-2025-59287
Oct 29, 2025
news.sophos.com reports: Windows Server Update Services (WSUS) vulnerability abused to harvest sensitive data
Oct 30, 2025
helpnetsecurity.com reports: Attackers exploiting WSUS vulnerability drop Skuld infostealer (CVE-2025-59287)
Nov 2, 2025
isc.sans.edu reports: Scans for Port 8530/8531 (TCP). Likely related to WSUS Vulnerability CVE-2025-59287, (Sun, Nov 2nd)
Nov 24, 2025
thehackernews.com reports: ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Public PoC (10)
github.com/jiansiting/CVE-2025-59287github.com/DaddyBigFish/CVE-2025-59287-hawktracegithub.com/garvitv14/CVE-2025-59287github.com/0xBruno/WSUSploit.NETgithub.com/Lupovis/Honeypot-for-CVE-2025-59287-WSUSgithub.com/FurkanKAYAPINAR/CVE-2025-59287github.com/tecxx/CVE-2025-59287-WSUSgithub.com/RadzaRr/WSUSRespondergithub.com/mubix/Find-WSUSgithub.com/mrk336/Breaking-the-Update-Chain-Inside-CVE-2025-59287-and-the-WSUS-RCE-Threat
Unverified third-party code — review before executing.