Description
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows Server 2012 | 6.2.9200.0 – < 6.2.9200.25728 | 6.2.9200.25728 |
| Microsoft | Windows Server 2012 (Server Core installation) | 6.2.9200.0 – < 6.2.9200.25728 | 6.2.9200.25728 |
| Microsoft | Windows Server 2012 R2 | 6.3.9600.0 – < 6.3.9600.22826 | 6.3.9600.22826 |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 – < 6.3.9600.22826 | 6.3.9600.22826 |
| Microsoft | Windows Server 2016 | 10.0.14393.0 – < 10.0.14393.8524 | 10.0.14393.8524 |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 – < 10.0.14393.8524 | 10.0.14393.8524 |
| Microsoft | Windows Server 2019 | 10.0.17763.0 – < 10.0.17763.7922 | 10.0.17763.7922 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 – < 10.0.17763.7922 | 10.0.17763.7922 |
| Microsoft | Windows Server 2022 | 10.0.20348.0 – < 10.0.20348.4297 | 10.0.20348.4297 |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 – < 10.0.25398.1916 | 10.0.25398.1916 |
| Microsoft | Windows Server 2025 | 10.0.26100.0 – < 10.0.26100.6905 | 10.0.26100.6905 |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 – < 10.0.26100.6905 | 10.0.26100.6905 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Windows Server Update Service Deserialization Remote Code Execution
exploit/windows/http/wsus_deserialization_rce
GitHub 23 repositories · most starred shown
-
jiansiting/CVE-2025-59287 ★ 174 · Oct 25, 2025
WSUS Unauthenticated RCE
-
mubix/Find-WSUS ★ 46 · Oct 27, 2025
Helps defenders find their WSUS configurations in the wake of CVE-2025-59287
-
Lupovis/Honeypot-for-CVE-2025-59287-WSUS ★ 26 · Oct 27, 2025
Defensive PoC decoy for CVE-2025-59287 (WSUS) - emulates WSUS endpoints, captures request bodies and metadata, saves evidence for forensic analysis, and provides validation harness and detection rule…
-
tecxx/CVE-2025-59287-WSUS ★ 18 · Oct 27, 2025
powershell version of hawktrace POC exploit
-
garvitv14/CVE-2025-59287 ★ 16 · Oct 25, 2025
Working exploit (PoC) for CVE-2025-59287 — WSUS vulnerability. Featured on Vulners and DeepWiki.
-
M507/CVE-2025-59287-PoC ★ 15 · Nov 16, 2025
Unauthenticated RCE PoC in Microsoft Windows Server Update Service (WSUS) - CVE-2025-59287 & CVE-2023-35317
-
QurtiDev/WSUS-CVE-2025-59287-RCE ★ 11 · Nov 1, 2025
Exploit script written in C# to aid gaining a reverse shell on targets with Windows Server Update Service(WSUS) CVE-2025-59287.
-
AdityaBhatt3010/CVE-2025-59287-When-your-patch-server-becomes-the-attack-vector ★ 10 · Oct 28, 2025
CVE-2025-59287 — Critical unauthenticated RCE in Windows Server Update Services (WSUS) via unsafe deserialization of an AuthorizationCookie, enabling SYSTEM-level compromise and active exploitation; …
-
0x7556/CVE-2025-59287 ★ 7 · Oct 30, 2025
CVE-2025-59287 注入WolfShell内存马
-
CVE-2025-59287 is a critical RCE vulnerability in Windows Server Update Services (WSUS) caused by unsafe deserialization of untrusted data. It allows remote attackers to execute arbitrary code withou…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Windows Server Update Service - Insecure Deserialization http/cves/2025/CVE-2025-59287.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 5
- ICSA-25-352-02 Schneider Electric EcoStruxure Foxboro DCS Advisor CISA ICS & IT advisories · Dec 18, 2025
- SEVD-2025-343-02 EcoStruxure™ Foxboro DCS Advisor Schneider Electric CPCERT · Dec 9, 2025
- WID-SEC-2025-2307 Microsoft Windows: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 25, 2025
- NCSC-2025-0310 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Oct 24, 2025
- MSRC-CVE-2025-59287 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability Microsoft Security Response Center · Oct 24, 2025
References
- Windows Server Update Service (WSUS) Remote Code Execution Vulnerability vendor-advisory patch