A deserialization flaw in WSUS allowed unauthenticated code execution. The first fix was incomplete; an emergency update followed after attacks began.
Publicly disclosed: 14 October 2025 (out-of-band fix: 23 October 2025)
WSUS distributes Windows updates inside company networks, so it is trusted by every computer. In October 2025 Microsoft fixed a critical deserialization flaw in WSUS as part of Patch Tuesday, but the fix turned out to be incomplete. After a public proof of concept appeared, Microsoft released an out-of-band update on 23 October, and attacks in the wild were confirmed the next day. CISA added it to its exploited catalog.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2025-59287 | Critical, CVSS 9.8 (deserialization, remote code execution) | Windows Server 2012 – 2025 with the WSUS role enabled | Out-of-band update of 23 October 2025 |
Infrastructure that every computer trusts must be protected like the most valuable server.
Sources: CERT-EU 2025-040, NVD CVE-2025-59287.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
