CyberSec.Space Logo
Back to CVE Browser

CVE-2025-59287

🔥 Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-10-14
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Affected Platforms (CPE)

💻
Microsoft

Windows Server 2012

All versions= r2
💻
Microsoft

Windows Server 2016

< 10.0.14393.8524
💻
Microsoft

Windows Server 2019

< 10.0.17763.7922
💻
Microsoft

Windows Server 2022

< 10.0.20348.4297

References & Advisories

🔗 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
🔗 https://hawktrace.com/blog/CVE-2025-59287
🔗 https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/
🔗 https://www.vicarius.io/vsociety/posts/cve-2025-59287-detection-script-rce-vulnerability-in-windows-server-update-service
🔗 https://www.vicarius.io/vsociety/posts/cve-2025-59287-mitigation-script-rce-vulnerability-in-windows-server-update-service
🔗 https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59287

Related Security Intelligence Articles

Weekly Cybersecurity News: Jul 27, 2026

Weekly cybersecurity news covering active exploitation of Check Point SmartConsole CVE-2026-16232, Qilin ransomware leveraging PAN-OS GlobalProtect vulnerabilities, Russian LAUNDRY BEAR targeting Zimbra email servers, and FakeGit malicious repositories.

2026-07-27

Global Cyber Intel Digest: July 24, 2026

This digest covers active exploitation of Check Point CVE-2026-16232 SmartConsole authentication bypass, Russian LAUNDRY BEAR targeting Zimbra vulnerabilities, malicious Claude Desktop ad campaigns deploying SectopRAT, and Chaos ransomware msaRAT operations.

2026-07-24

Global Cyber Intel Digest: July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

2026-07-23

Related Vulnerabilities

CVE-2026-579174.8

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing th...

CVE-2025-15662

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL be...

CVE-2026-174582.1

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser...

CVE-2026-174342.1

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-...