A critical remote code execution (RCE) vulnerability — CVE-2025-59287 — has been discovered in Windows Server Update Services (WSUS).
The flaw impacts servers configured with the WSUS Server role acting as an update source for other WSUS servers (❗ not enabled by default).
Despite limited exposure, threat actors are now actively scanning and exploiting the flaw, following the release of public proof-of-concept (PoC) exploit code.
Why This Matters
- Remote code execution with SYSTEM privileges — no user interaction or authentication required.
- Low-complexity exploitation and potentially wormable behavior between WSUS servers.
- PoC exploit is publicly available, accelerating attacks and scanning activity.
- Confirmed exploitation by Eye Security and Huntress Labs, observed since October 24, 2025.
Who’s Affected
- Servers with WSUS Server role configured as upstream update sources.
- Systems with ports 8530 (HTTP) or 8531 (HTTPS) are exposed to the Internet.
- According to Eye Security and Huntress:
- 🌍 ~2,500 WSUS instances exposed worldwide
- 🇩🇪 ~250 in Germany, 🇳🇱 ~100 in the Netherlands
Huntress reported attackers executing PowerShell reconnaissance commands and exfiltrating results via webhooks:
whoami
net user /domain
ipconfig /all
Immediate Actions
1️⃣ Patch Immediately
Microsoft released out-of-band security updates for all affected Windows Server versions — install ASAP:
- Windows Server 2025 — KB5070881
- Windows Server, version 23H2 — KB5070879
- Windows Server 2022 — KB5070884
- Windows Server 2019 — KB5070883
- Windows Server 2016 — KB5070882
- Windows Server 2012 R2 — KB5070886
- Windows Server 2012 — KB5070887
2️⃣ If You Can’t Patch Immediately
- ❌ Disable the WSUS Server role on affected systems.
- 🔒 Block inbound connections on ports 8530 / 8531 at firewalls or gateways.
- 🕵️ Monitor for suspicious PowerShell or HTTP traffic from WSUS hosts.
3️⃣ Detection & Investigation
- Search for:
whoami,net user /domain,ipconfig /allexecuted unexpectedly.- Outbound HTTP POST traffic to unknown or external domains (potential data exfiltration).
Official Advisories & Research
- Microsoft: CVE-2025-59287 (Exploitation More Likely)
- Eye Security: Active exploitation confirmed
- Huntress Labs: Observed reconnaissance and data collection activity
- NCSC-NL: Confirmed exploitation in the wild
Alcaeus Services Recommendation
This is a high-priority, actively exploited RCE with public PoC code — patching is critical.
Even though WSUS is not typically exposed online, internal lateral movement via chained attacks is possible.
At Alcaeus Services, we recommend:
- 🚀 Immediate patch orchestration across WSUS environments
- 🧰 Threat hunting for early indicators of compromise
- 🧱 WSUS hardening and network segmentation to limit future exposure
- 🔍 Continuous vulnerability monitoring with automated patch validation
