Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

How could an attacker exploit this vulnerability?
A remote, unauthenticated attacker could send a crafted event that triggers unsafe object deserialization in a legacy serialization mechanism, resulting in remote code execution.

What actions do I need to take to be protected from this vulnerability?
To fully address this vulnerability:
Windows Server customers should install the out-of-band update released on October 23, 2025., Windows Servers enrolled into the hotpatch program should install the out-of-band standalone security update released on October 24, 2025.
If you cannot install the update immediately see the Workaround section for actions you can take to be protected.

Will the out-of-band update released on October 23, 2025 require a Windows server reboot?
Yes. After you install the update you will need to reboot your system.
Yes. A reboot will be required only on servers that have WSUS enabled. This update will not reset the previous baseline.

How I do get the October 23, 2025 out of band security update?
The update is available through the following channels:
For customers who automatically install updates, this update will be downloaded and installed automatically from Windows Update and Microsoft Update., The standalone package for this update is available on the Microsoft Update Catalog website., This update will automatically sync with Windows Server Update Services (WSUS).
Windows Server 2022:
For customers who automatically install updates, this update will be downloaded and installed automatically from Windows Update., This update will automatically sync with Windows Server Update Services (WSUS).
Windows Server 2025:
For customers who automatically install updates, this update will be downloaded and installed automatically from Windows Update only.

Why did the Temporal CVSS score change?
Microsoft has updated the Exploit Code Maturity metric of the CVSS Temporal score from Unproven (U) to Proof-of-Concept (P) after confirming the availability of publicly disclosed PoC code for this CVE.

Will an updated Windows Update offline scan file, Wsusscn2.cab, with this new security update be available?
Yes. An updates scan file will be available at the time of, or shortly after, the release.

Security updates
10.0.17763.7922 — https://support.microsoft.com/help/5070883
10.0.20348.4297 — https://support.microsoft.com/help/5070884
10.0.20348.4297 — https://support.microsoft.com/help/5070892
10.0.26100.6905 — https://support.microsoft.com/help/5070881
10.0.26100.6905 — https://support.microsoft.com/help/5070893
10.0.25398.1916 — https://support.microsoft.com/help/5070879
10.0.14393.8524 — https://support.microsoft.com/help/5070882
6.2.9200.25728 — https://support.microsoft.com/help/5070887
6.3.9600.22826 — https://support.microsoft.com/help/5070886