【資安漏洞預警】Windows Server Update Services存在高風險安全漏洞(CVE-2025-59287)，請儘速確認並進行修補

【行政公告】

公告單位	圖資處數位服務組
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】Windows Server Update Services存在高風險安全漏洞(CVE-2025-59287)，請儘速確認並進行修補 [Security Vulnerability Alert] A high-risk security vulnerability (CVE-2025-59287) exists in Windows Server Update Services. Please confirm and patch it as soon as possible.
公告內容	轉發國家資安資訊分享與分析中心 NISAC-200-202510-00000233 [內容說明] 研究人員發現Windows Server Update Services存在不安全之反序列化(Deserialization of Untrusted Data)漏洞(CVE-2025-59287)。未經身分鑑別之遠端攻擊者，可透過向WSUS伺服器發送特製事件以系統權限執行任意程式碼。該漏洞已遭駭客利用，請儘速確認並進行修補。 [影響平台] ● Windows Server 2025 (Server Core installation) ● Windows Server 2025 ● Windows Server 2022, 23H2 Edition (Server Core installation) ● Windows Server 2022 (Server Core installation) ● Windows Server 2022 ● Windows Server 2019 (Server Core installation) ● Windows Server 2019 ● Windows Server 2016 (Server Core installation) ● Windows Server 2016 ● Windows Server 2012 R2 (Server Core installation) ● Windows Server 2012 R2 ● Windows Server 2012 (Server Core installation) ● Windows Server 2012 [建議措施] 官方已針對漏洞釋出修復更新，請參考官方說明進行更新，網址如下： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 [參考資料] 1. https://nvd.nist.gov/vuln/detail/CVE-2025-59287 2. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 3. https://www.cisa.gov/news-events/alerts/2025/10/24/microsoft-releases-out-band-security-update-mitigate-windows-server-update-service-vulnerability-cve 4. https://www.helpnetsecurity.com/2025/10/24/wsus-vulnerability-cve-2025-59287-exploited/ Forwarded from the National Center for Cybersecurity Information Sharing and Analysis (NSAC-200-202510-00000233) [Content Description] Researchers have discovered a vulnerability (CVE-2025-59287) in Windows Server Update Services that allows for insecure deserialization of untrusted data. An unauthenticated remote attacker could execute arbitrary code with system privileges by sending specially crafted events to the WSUS server. This vulnerability has already been exploited by hackers; please confirm and patch it as soon as possible. [Affected Platforms] ● Windows Server 2025 (Server Core installation) ● Windows Server 2025 ● Windows Server 2022, 23H2 Edition (Server Core installation) ● Windows Server 2022 (Server Core installation) ● Windows Server 2022 ● Windows Server 2019 (Server Core installation) ● Windows Server 2019 ● Windows Server 2016 (Server Core installation) ● Windows Server 2016 ● Windows Server 2012 R2 (Server Core installation) ● Windows Server 2012 R2 ● Windows Server 2012 (Server Core installation) ● Windows Server 2012 [Recommended Actions] An official patch has been released to fix the vulnerability. Please refer to the official instructions to update. The URL is as follows: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 [References] 1. https://nvd.nist.gov/vuln/detail/CVE-2025-59287 2. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 3. https://www.cisa.gov/news-events/alerts/2025/10/24/microsoft-releases-out-band-security-update-mitigate-windows-server-update-service-vulnerability-cve 4. https://www.helpnetsecurity.com/2025/10/24/wsus-vulnerability-cve-2025-59287-exploited/
相關訊息
公告時間	2025/10/30 至 2026/4/30	點閱次數	257