Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
Microsoft — Windows Server 2012
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
9.8
100.0%
Vector breakdown
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- Oct 14, 2025
- Modified
- Jun 17, 2026
- Added to KEV
- Oct 24, 2025
- Federal patch due
- Nov 14, 2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Weakness classification
Affected packages
Proof-of-concept & exploitation references
8 foundWeaponization
Public repositories whose name or description references CVE-2025-59287, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit - cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.
- jiansiting/CVE-2025-59287★ 174
WSUS Unauthenticated RCE
updated Oct 8, 2026
- mubix/Find-WSUS★ 46
Helps defenders find their WSUS configurations in the wake of CVE-2025-59287
updated Jul 13, 2026
- Lupovis/Honeypot-for-CVE-2025-59287-WSUS★ 26
Defensive PoC decoy for CVE-2025-59287 (WSUS) - emulates WSUS endpoints, captures request bodies and metadata, saves evidence for forensic analysis, and provides validation harness and detection rules.
updated Jan 18, 2026
- tecxx/CVE-2025-59287-WSUS★ 18
powershell version of hawktrace POC exploit
updated Apr 20, 2026
- garvitv14/CVE-2025-59287★ 16
Working exploit (PoC) for CVE-2025-59287 — WSUS vulnerability. Featured on Vulners and DeepWiki.
updated Aug 19, 2026
- M507/CVE-2025-59287-PoC★ 15
Unauthenticated RCE PoC in Microsoft Windows Server Update Service (WSUS) - CVE-2025-59287 & CVE-2023-35317
updated Aug 24, 2026
- QurtiDev/WSUS-CVE-2025-59287-RCE★ 11
Exploit script written in C# to aid gaining a reverse shell on targets with Windows Server Update Service(WSUS) CVE-2025-59287.
updated Sep 25, 2026
- AdityaBhatt3010/CVE-2025-59287-When-your-patch-server-becomes-the-attack-vector★ 10
CVE-2025-59287 — Critical unauthenticated RCE in Windows Server Update Services (WSUS) via unsafe deserialization of an AuthorizationCookie, enabling SYSTEM-level compromise and active exploitation; patch or isolate WSUS (ports 8530/8531) immediately.
updated May 4, 2026
References
How this class of flaw gets exploited
Frequently asked questions
What is CVE-2025-59287?
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
How severe is CVE-2025-59287?
CVE-2025-59287 has a CVSS base score of 9.8 out of 10 (CVSS 3.1).
Is CVE-2025-59287 actively exploited in the wild?
Yes. CVE-2025-59287 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Oct 24, 2025, meaning CISA has confirmed evidence of active exploitation.
What is the EPSS score for CVE-2025-59287?
100.0% - meaning FIRST.org's EPSS model estimates a 100.0% probability this vulnerability will be exploited in the wild within 30 days (100% percentile among all scored CVEs).
Is there exploit tooling available for CVE-2025-59287?
Yes - a public Nuclei template referencing CVE-2025-59287 exist in public repositories we checked. We also found 8 public GitHub repositories referencing this CVE.
What type of vulnerability is CVE-2025-59287?
CVE-2025-59287 is classified under CWE-502 (CWE-502: Deserialization of Untrusted Data).
Cross-checked against
Impactr finds and proves whether CVE-2025-59287 - or flaws like it - are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.
Join the waitlist