CVE-2025-59287: critical vulnerability in Microsoft Windows Server 2012
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Windows Server Update Service (WSUS) incorrectly processes untrusted data from the network, allowing attackers to execute arbitrary code on the server without authentication. This is a critical flaw because WSUS is often trusted to manage security updates across entire organizations.
CWE-502 deserialization vulnerability in WSUS enables remote code execution via malicious network packets. The attack requires network access to the WSUS service but no authentication; exploitation results in complete system compromise with the privileges of the WSUS process.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.