PT-2025-42147 · Microsoft · Windows Server Update Services +1

Published 2025-10-14 · Updated 2025-11-30 · CVE-2025-59287

Positive Technologies · (AI Summary)

CVSS v2.0

10

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Server Update Services (WSUS) versions prior to the October 2025 security updates.

Description A critical remote code execution (RCE) vulnerability exists in Windows Server Update Services (WSUS), identified as CVE-2025-59287. This flaw stems from unsafe deserialization of untrusted data, allowing unauthenticated attackers to execute arbitrary code with SYSTEM privileges. Active exploitation of this vulnerability has been observed in the wild, with threat actors deploying malware such as ShadowPad. Attackers are utilizing various tools, including PowerCat, curl, and certutil, to gain shell access and install malicious payloads. The vulnerability affects systems running WSUS and has been actively exploited since October 2025. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching.

Recommendations Apply the latest security updates released by Microsoft for Windows Server Update Services (WSUS). If patching is not immediately possible, consider disabling the WSUS role or blocking inbound traffic on ports 8530 and 8531. Monitor WSUS server logs for suspicious activity and implement detection rules to identify potential exploitation attempts.

Exploit

Fix

LPE

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-12999

CVE-2025-59287

Affected Products

Windows

Windows Server Update Services

References · 450

• 🔥 https://github.com/th1n0/CVE-2025-59287 · Exploit
• 🔥 https://github.com/Sid6Effect/CVE-2025-59287 · Exploit
• 🔥 https://github.com/Lupovis/Honeypot-for-CVE-2025-59287-WSUS · Exploit
• 🔥 https://github.com/SUmidcyber/YaraRule/tree/main/CVE-2025-59287 · Exploit
• 🔥 https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951 · Exploit
• 🔥 https://hawktrace.com/blog/CVE-2025-59287 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59287 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59287 · Security Note
• https://bdu.fstec.ru/vul/2025-12999 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-59287 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-59287 · Vendor Advisory
• https://github.com/besimorhino/powercat · Note
• https://github.com/SUmidcyber/YaraRule · Note
• https://twitter.com/JocytaMama/status/1983491755568685476 · Twitter Post