CVE-2025-59287

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Microsoft	Windows Server 2012	>= 6.2.9200.0, < 6.2.9200.25728
Microsoft	Windows Server 2012 (Server Core installation)	>= 6.2.9200.0, < 6.2.9200.25728
Microsoft	Windows Server 2012 R2	>= 6.3.9600.0, < 6.3.9600.22826
Microsoft	Windows Server 2012 R2 (Server Core installation)	>= 6.3.9600.0, < 6.3.9600.22826
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.8524
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.8524
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.7922
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.7922
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.4297
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	>= 10.0.25398.0, < 10.0.25398.1916
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.6905
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.6905

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287Vendor Advisory
https://hawktrace.com/blog/CVE-2025-59287Exploit, Third Party Advisory
https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/Press/Media Coverage
https://www.vicarius.io/vsociety/posts/cve-2025-59287-detection-script-rce-vulnerability-in-windows-server-update-serviceThird Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-59287-mitigation-script-rce-vulnerability-in-windows-server-update-serviceMitigation, Third Party Advisory
https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59287Third Party Advisory, US Government Resource

Timeline

Published: Oct 14, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Oct 24, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-592885.3Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent CVE-2025-592897.0Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.CVE-2025-59295.4The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and CVE-2025-592907.8Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.CVE-2025-592918.2External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.CVE-2025-592928.2External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.CVE-2025-592944.6Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information w CVE-2025-592958.8Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network.CVE-2025-592977.8Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage th CVE-2025-592987.8Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage th CVE-2025-592997.8Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage th CVE-2025-59304.3The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to mis