Actively exploited in the wild
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2025-10-24. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-59287
CriticalCVSS 9.8KEVSummary
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Risk Assessment
An attacker could remotely execute arbitrary code on the WSUS server, potentially taking over the update infrastructure and further propagating threats.
Recommendation
Immediately apply Microsoft security patches for Windows Server Update Service and restrict network access to the WSUS service.
Other vulnerabilities in Windows Server Update Service
See all- CVE-2026-50444High
Missing authentication for a critical function in Windows Server Update Service (WSUS) allows an authorized attacker to elevate privileges over a network.
- CVE-2026-50328High
An unhandled exception in Windows Server Update Service (WSUS) allows an unauthorized attacker to perform tampering over a network. This vulnerability could compromise the integrity of updates.
- CVE-2026-20856High
Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Original NVD description (English source)
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.