Microsoft Issues Emergency Patch for Critical WSUS Flaw

In a rare out-of-band security update, Microsoft has released a critical fix for a newly discovered vulnerability in its Windows Server Update Services (WSUS) that is already being actively exploited in the wild. With organizations worldwide still reeling from a barrage of cyber-threats, this urgent patch underscores the escalating risk posed by insecure update infrastructure and highlights the need for immediate remediation.

Vulnerability Details & Exploitation

The flaw, tracked as CVE‑2025‑59287 (with a CVSS score of 9.8), is a remote code execution vulnerability impacting WSUS instances when the Server Role is enabled. It arises due to “unsafe deserialization of AuthorizationCookie objects” sent to the GetCookie() endpoint, which decrypts AES-128-CBC data and then passes it into the .NET BinaryFormatter without proper type validation. This chain allows an attacker to gain SYSTEM privileges.
Microsoft’s advisory confirms the update applies to supported versions of Windows Server including 2012, 2012 R2, 2016, 2019 and 2022, plus the 23H2 Edition “Server Core installation”.
Significantly, the exploit is live. Security researchers at Eye Security and Huntress report that threat actors have been targeting WSUS endpoints exposed on ports 8530 and 8531 since around October 24, 2025. A payload was observed that used a simple “aaaa” HTTP header value to execute commands via cmd.exe and PowerShell.
Microsoft noted that initial mitigation did not fully address the issue and re-released the CVE accordingly.

Background & Risk Context

WSUS forms a key part of Microsoft’s patch-management and update-distribution infrastructure for Windows-based systems. When misconfigured or exposed, it becomes a high-value target for attackers seeking to deploy malicious code across an enterprise. This newly discovered deserialization flaw is particularly worrying because BinaryFormatter has long been flagged as unsafe for handling untrusted input. In fact, Microsoft removed it in .NET 9 as of August 2024.
The weakness is not universal: it affects only servers where the WSUS Server Role is enabled. Servers without this role are unaffected, according to Microsoft.
Further raising the stakes, the Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, meaning U.S. federal agencies are required to remediate by 14 November 2025.

Expert Insights & Mitigation Guidance

According to Eye Security’s CTO, Piet Kerkhofs:

“The payload uses the request header with the name ‘aaaa’ as a source for the command that is to be executed … This avoids commands appearing directly in the log.”
Huntress reported:
“Attackers leveraged exposed WSUS endpoints to send specially crafted requests (multiple POST calls to WSUS web services) that triggered a deserialization RCE against the update service.”
Given the public proof-of-concept and active exploitation, organisations are urged not to delay. Microsoft recommends applying the out-of-band update and then rebooting the server. For cases where patching isn’t immediately feasible, Microsoft and NCSC-NL advise temporary mitigations:

• Disable the WSUS Server Role if enabled.
• Block inbound traffic to ports 8530 and 8531 on the host firewall.
  It is vital not to disable these workarounds after applying the patch until full verification of the fix.

Conclusion

The discovery and rapid exploitation of CVE-2025-59287 demonstrate how even trusted enterprise infrastructure—such as WSUS—can become a vector for high-impact attacks. With an RCE in the wild that permits SYSTEM-level execution via exposed update services, the threat is real and imminent. Organisations using WSUS must treat this as high priority: verify whether the Server Role is enabled, patch immediately, ensure firewall protections are in place, and audit exposure of ports 8530/8531. Delay could invite unwanted execution of attacker-controlled code, data exfiltration or network compromise. For cybersecurity teams already stretched, this is a sharp reminder: patch management remains one of the most critical, yet under-resourced parts of defence.