deserialization Archives

Winsage

October 31, 2025

Windows Server Update Service exploitation ensnares at least 50 victims

Over 50 organizations in the United States have been targeted in attacks exploiting a vulnerability in the Windows Server Update Service (WSUS), identified as CVE-2025-59287, related to the deserialization of untrusted data. Despite a security update from Microsoft in mid-October, an emergency out-of-band update was issued due to its inadequacy. Sophos recorded six incidents linked to this exploitation, with indications of broader impacts. The affected sectors include technology, education, manufacturing, and healthcare. The hacker group UNC6512 has been connected to these activities, conducting reconnaissance and exfiltrating sensitive data. Sophos detected malicious activity on October 24, following the release of the out-of-band patch. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and urged security teams to apply necessary patches and check for signs of compromise.

Winsage

October 31, 2025

Windows Server Update Services (WSUS) vulnerability abused to harvest sensitive data

Counter Threat Unit™ (CTU) researchers are investigating a remote code execution vulnerability, CVE-2025-59287, in Microsoft’s Windows Server Update Service (WSUS). Microsoft released patches for affected Windows Server versions on October 14, 2025, and issued an out-of-band security update on October 23 after the emergence of proof-of-concept code. On October 24, Sophos detected exploitation of this vulnerability targeting internet-facing WSUS servers across various industries. The first recorded activity occurred at 02:53 UTC, where a threat actor executed a Base64-encoded PowerShell script to collect and exfiltrate sensitive information to Webhook.site. The script gathered data such as external IP addresses, Active Directory domain users, and network configurations, attempting to send this information via HTTP POST requests. By 11:32 UTC, the maximum limit of 100 requests was reached. Affected entities included universities and organizations in technology, manufacturing, and healthcare sectors, primarily in the United States. Censys scan data confirmed that the exploited servers had default WSUS ports 8530 and 8531 exposed publicly. CTU recommends organizations review vendor advisories, apply patches, identify exposed WSUS server interfaces, and examine logs for malicious activity. Sophos has implemented specific protections to detect related activities.

Winsage

October 29, 2025

Warnings Mount Over Windows Server Update Services Hacks

Concerns have increased regarding a critical vulnerability in Windows Server Update Services (WSUS), identified as CVE-2025-59287, which allows unauthenticated attackers to execute arbitrary code. This vulnerability arises from a legacy serialization mechanism within WSUS, which is no longer actively developed. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, indicating its urgency. Cybersecurity firms have reported active exploitation attempts, with thousands of WSUS instances exposed to the internet. Attacks are primarily reconnaissance activities that could lead to broader network compromises. If an attacker compromises a single server, they could control the entire patch distribution system, enabling internal supply chain attacks and distributing malware disguised as legitimate Microsoft updates. Alerts have been issued by the Canadian Center for Cybersecurity and the Australian Cyber Security Centre regarding this global threat. Microsoft's initial patch on October 15 failed to fully resolve the issue, allowing attackers to exploit the vulnerability quickly. Attack vectors include exploiting the deserialization of AuthorizationCookie objects and unsafe deserialization via the ReportingWebService. The vulnerability is particularly concerning because WSUS is often neglected and should not be exposed to the internet.

Winsage

October 28, 2025

Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild

On October 14, 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-59287, was discovered in Microsoft's Windows Server Update Services (WSUS). The vulnerability allows remote, unauthenticated attackers to execute arbitrary code with system privileges on affected servers. It was initially addressed on October 14, but the patch was insufficient, leading to an urgent out-of-band update on October 23. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities Catalog on October 24, indicating its immediate threat. The vulnerability affects Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, specifically on servers with the WSUS role enabled. Attackers are exploiting the vulnerability by targeting publicly exposed WSUS instances on TCP ports 8530 (HTTP) and 8531 (HTTPS). Approximately 5,500 WSUS instances have been identified as exposed to the internet. Microsoft recommends disabling the WSUS Server Role or blocking inbound traffic to the high-risk ports as temporary workarounds for organizations unable to apply the emergency patches immediately.

Winsage

October 25, 2025

Microsoft Releases Emergency Patch for Exploited Critical Remote Code Execution Vulnerability (CVE-2025-59287)

On October 23, 2025, Microsoft released an out-of-band security update for a critical vulnerability identified as CVE-2025-59287, which affects Windows Server Update Services (WSUS) and allows remote, unauthenticated attackers to execute arbitrary code. The vulnerability was initially addressed in the October Patch Tuesday update, but the original patch was deemed insufficient. Following the release of the new patch, threat actors began exploiting the vulnerability, leading to its inclusion in CISA’s Known Exploited Vulnerabilities Catalog. Technical details and proof-of-concept exploits for CVE-2025-59287 have been made publicly available. Arctic Wolf has been monitoring a threat campaign targeting WSUS servers through ports 8530 and 8531, involving a malicious PowerShell script that executes commands to gather information from the domain. Arctic Wolf has established Managed Detection and Response coverage for these activities and recommends upgrading to the latest fixed versions of Windows Server and installing the Arctic Wolf Agent and Sysmon for visibility into related events. For users unable to apply the update immediately, Microsoft suggests disabling WSUS or blocking inbound traffic to ports 8530 and 8531 as temporary mitigations.

Winsage

October 25, 2025

Windows Server WSUS bug exploits underway, Microsoft’s mum

A critical vulnerability in Microsoft Windows Server Update Services (WSUS), identified as CVE-2025-59287, has a CVSS score of 9.8 out of 10 and affects Windows Server versions from 2012 to 2025. The vulnerability arises from the insecure deserialization of untrusted data, allowing unauthenticated attackers to execute arbitrary code on compromised systems. Servers without the WSUS role enabled are unaffected. Microsoft issued a patch on October 14, which did not fully resolve the issue, leading to an emergency update. Security researcher Kevin Beaumont reported that he could manipulate the second patch, raising concerns about the delivery of malicious updates. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-59287 to its Known Exploited Vulnerabilities catalog, while the Dutch National Cybersecurity Center issued alerts about ongoing exploitation activities. Private security firms, including Huntress and watchTowr, reported targeted attacks on WSUS instances, with fewer than 25 susceptible hosts identified. WatchTowr's CEO warned that any unpatched WSUS instance online is likely compromised, urging organizations to reassess their security posture.

Winsage

October 24, 2025

Microsoft Issues Emergency Patch for Actively Exploited Critical WSUS Vulnerability

Microsoft has released out-of-band security updates to address a critical vulnerability in the Windows Server Update Service (WSUS), identified as CVE-2025-59287, which has a CVSS score of 9.8 and is actively being exploited. The vulnerability allows unauthorized remote code execution due to unsafe deserialization of untrusted data. It affects various supported versions of Windows Server, including 2012, 2012 R2, 2016, 2019, 2022, and 2025 (23H2 Edition, Server Core installation). Microsoft recommends applying the patch and rebooting the system, or alternatively, disabling the WSUS Server Role or blocking inbound traffic to Ports 8530 and 8531. The Dutch National Cyber Security Centre (NCSC) reported active exploitation on the same day the updates were released. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to address it by November 14, 2025.

Winsage

October 24, 2025

Microsoft issues emergency Windows server security patch – update now or risk attack

Microsoft has released an emergency patch for a critical vulnerability in its Windows Server Update Service (WSUS), identified as CVE-2025-59287, as part of the Patch Tuesday cumulative release on October 14, 2025. The vulnerability, categorized as a "deserialization of untrusted data" issue, has a severity score of 9.8 out of 10 and allows unauthenticated attackers to execute remote code without user interaction, potentially leading to broader network compromises. The flaw can be exploited with low-complexity attacks, and public exploit code has emerged, prompting the urgent update. Organizations are advised to apply the patch promptly to protect their systems.

Winsage

October 24, 2025

Microsoft Releases Emergency Patch For Windows Server Update Service RCE Vulnerability

Microsoft released an emergency patch on October 23, 2025, to address a critical remote code execution vulnerability (CVE-2025-59287) in Windows Server Update Services (WSUS). The vulnerability, rated critical with a CVSS score of 9.8, allows unauthorized attackers to execute arbitrary code over the network through unsafe deserialization of untrusted data. Although WSUS is not enabled by default, organizations using it are at risk if unpatched. The CVE's temporal score was updated to 8.8 after proof-of-concept exploit code was confirmed. The patch is available through various Microsoft update channels but requires a server reboot. Temporary workarounds include disabling the WSUS server role or blocking specific inbound traffic. Affected versions include Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 (23H2 Edition), and 2025, each with corresponding patch KB numbers.

Winsage

October 24, 2025

Microsoft releases urgent fix for actively exploited WSUS vulnerability (CVE-2025-59287)

Microsoft has released an out-of-band security update to address the critical CVE-2025-59287 vulnerability, which affects Windows Server Update Services (WSUS) and is currently being exploited. This vulnerability allows unauthorized attackers to execute code on vulnerable machines without user interaction by sending specially crafted events to the WSUS server. It specifically impacts Windows Server machines with the WSUS Server role enabled. The initial fix provided in October 2025 was insufficient, leading to the release of this additional update. The German Federal Office for Information Security has raised concerns about potential exploitation if network configurations are not properly managed. Compromised WSUS servers could distribute malicious updates to client devices. The update is available for all supported Windows Server versions and requires a reboot. Administrators can temporarily disable the WSUS server role or block inbound traffic to specific ports if immediate implementation is not possible. This cumulative update supersedes all prior updates for affected versions.