{"id":39107,"date":"2025-10-24T11:40:33","date_gmt":"2025-10-24T15:40:33","guid":{"rendered":"https:\/\/www.yorku.ca\/uit\/?p=39107"},"modified":"2025-10-24T10:43:16","modified_gmt":"2025-10-24T15:43:16","slug":"wsus-remote-code-execution-vulnerability-cve-2025-59287","status":"publish","type":"post","link":"https:\/\/www.yorku.ca\/uit\/2025\/10\/wsus-remote-code-execution-vulnerability-cve-2025-59287\/","title":{"rendered":"WSUS Remote Code Execution Vulnerability (CVE-2025-59287)"},"content":{"rendered":"
\n
\n
\n

 <\/o:p><\/span><\/p>\n

\n\n\n\n
\n\n\n\n\n
<\/td>\n<\/tr>\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n\n
<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n
\n\n\n\n
\n\n\n\n
\n\n\n\n\n
\n

\"A<\/span><\/o:p><\/span><\/p>\n

 <\/o:p><\/span><\/p>\n

Service <\/span> <\/b>Advisory <\/span><\/b><\/o:p><\/span><\/p>\n


<\/span>Microsoft has released an urgent out-of-band security update to address a critical remote code execution (RCE) vulnerability in Windows Server Update Services (WSUS). The flaw tracked as CVE-2025-59287, poses a direct risk to organizations that utilizes WSUS to manage Windows updates.
<\/span>
Severity level<\/span><\/b>:
<\/span><\/b>CVSS Score: 9.8 \/Critical

Description<\/b>:
Windows Server Update Services (WSUS) is a widely used Microsoft tool for managing the distribution of updates in enterprise environments. CVE-2025-59287 is a critical deserialization of untrusted data vulnerability that may allow an unauthorized attacker to execute code on vulnerable machines by sending a specially crafted event to the WSUS server. No user interaction is required to trigger it.
<\/span>
Affected Versions:
<\/b>Windows Server 2012 through 2025 with WSUS role enabled.

Impact:
<\/b>Successful exploitation allows attackers to execute arbitrary code with System-level privileges.
<\/span>
Resolution:
<\/b>Please update to the latest patched versions of Windows Server as provided by Microsoft. If immediate patching is not feasible:<\/o:p><\/span><\/span><\/p>\n

\n\n\n\n
\n\n\n\n\n
\n

 <\/o:p><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n

\n\n\n\n
\n\n\n\n
\n\n\n\n\n
<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n

PRIVACY POLICY<\/span><\/a> | <\/span>VISIT WWW.YORKU.CA<\/span><\/a>
This email was sent by: ¿ì²¥ÊÓƵ, 4700 Keele Street, Toronto, Ontario M3J 1P3<\/b> <\/span><\/o:p><\/span><\/p>\n

This email is viewed best in Microsoft Outlook for web <\/span><\/o:p><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n

 <\/o:p><\/span><\/p>\n

 <\/o:p><\/span><\/p>\n

 <\/o:p><\/p>\n

 <\/o:p><\/span><\/p>\n

 <\/o:p><\/p>\n

 <\/o:p><\/span><\/p>\n

 <\/o:p><\/span><\/p><\/div>\n<\/p><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    Service Advisory  Microsoft has released an urgent out-of-band security update to address a critical remote code execution (RCE) vulnerability in Windows Server Update Services (WSUS). The flaw tracked as CVE-2025-59287, poses a direct risk to organizations that utilizes WSUS to manage Windows updates. Severity level: CVSS Score: 9.8 \/Critical Description: Windows Server Update […]<\/p>\n","protected":false},"author":212,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","footnotes":""},"categories":[29],"tags":[],"class_list":["post-39107","post","type-post","status-publish","format-standard","hentry","category-news"],"taxonomy_info":{"category":[{"value":29,"label":"News"}]},"featured_image_src_large":false,"author_info":{"display_name":"aalaily","author_link":"https:\/\/www.yorku.ca\/uit\/author\/aalaily\/"},"comment_info":"","category_info":[{"term_id":29,"name":"News","slug":"news","term_group":0,"term_taxonomy_id":3,"taxonomy":"category","description":"","parent":0,"count":486,"filter":"raw","cat_ID":29,"category_count":486,"category_description":"","cat_name":"News","category_nicename":"news","category_parent":0}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/posts\/39107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/users\/212"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/comments?post=39107"}],"version-history":[{"count":0,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/posts\/39107\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/media?parent=39107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/categories?post=39107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/tags?post=39107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}