Forwarded from the National Center for Cybersecurity Information Sharing and Analysis (NSAC-200-202510-00000233)

[Content Description] Researchers have discovered a vulnerability (CVE-2025-59287) in Windows Server Update Services that allows for insecure deserialization of untrusted data. An unauthenticated remote attacker could execute arbitrary code with system privileges by sending specially crafted events to the WSUS server. This vulnerability has already been exploited by hackers; please confirm and patch it as soon as possible.

[Affected Platforms]
● Windows Server 2025 (Server Core installation)
● Windows Server 2025
● Windows Server 2022, 23H2 Edition (Server Core installation)
● Windows Server 2022 (Server Core installation)
● Windows Server 2022
● Windows Server 2019 (Server Core installation)
● Windows Server 2019
● Windows Server 2016 (Server Core installation)
● Windows Server 2016
● Windows Server 2012 R2 (Server Core installation)
● Windows Server 2012 R2
● Windows Server 2012 (Server Core installation)
● Windows Server 2012

[Recommended Actions] An official patch has been released to fix the vulnerability. Please refer to the official instructions to update. The URL is as follows: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287

[References]
1. https://nvd.nist.gov/vuln/detail/CVE-2025-59287
2. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
3. https://www.cisa.gov/news-events/alerts/2025/10/24/microsoft-releases-out-band-security-update-mitigate-windows-server-update-service-vulnerability-cve
4. https://www.helpnetsecurity.com/2025/10/24/wsus-vulnerability-cve-2025-59287-exploited/