LevelBlue Labs is tracking a severe vulnerability in Windows Server Update Services (WSUS), CVE-2025-59287, that allows attackers to remotely execute code without authentication and is being exploited by threat actors to compromise vulnerable Windows Server users.
Windows Server Update Services (WSUS) is a Microsoft tool that enables IT administrators to manage the distribution of updates and hotfixes released for Microsoft products to computers in a corporate environment. Instead of every device downloading updates directly from Microsoft, WSUS acts as a centralized server that downloads updates once and then distributes them to client machines. This setup helps reduce bandwidth usage, ensures compliance, and gives admins control over what gets installed and when.
Since WSUS is designed for internal network use, it is expected that basic network hygiene is applied and that the server is kept behind a firewall or VPN to block any exploitation attempts. Any client machine communicating with WSUS should use port 8530 for HTTP and port 8531 for HTTPS.
The vulnerability, CVE-2025-59287, is a deserialization vulnerability of data sent to the server through the API. The .NET component is responsible for deserialization, which fails to enforce strict type validation, allowing an unauthenticated attacker to send a crafted request containing a malicious serialized payload that would be executed with SYSTEM privileges.
The vulnerability impacts Windows Server versions from 2012 to 2025 as long as the WSUS Server Role is enabled and the threat actor has access to the server, which should not occur too often.
The severity of the vulnerability resides in the nature of these servers, being a trusted update distribution point. If successfully exploited, these could become a source of a supply chain compromise from inside the organization and quickly move laterally through the network. This vulnerability has quickly escalated its severity and drawn significant attention across cybersecurity communities, not only because of the supply chain implications, but also because of Microsoft’s need to release an out-of-band security update, as we can see in the timeline:
Monitor for anomalous child processes spawned by WSUS-related executables, particularly wsusservice.exe and w3wp.exe (IIS worker process). These processes should normally handle update synchronization and web service operations, not execute arbitrary commands or launch PowerShell or any other command-line or scripting engines.
Review the released Suricata detection. LevelBlue Labs has released one that looks at potential exploit content in post requests to ReportingWebService.asmx. Additionally, ProofPoint, in its Emerging Threats open detections, has released two rules to detect exploit attempts: one looks at the abovementioned endpoint, while the second looks at ClientWebService/Client.asmx and inspects the cookie’s body.
If the previous methods have not fully clarified whether the device could be infected, LevelBlue recommends a full network telemetry review to identify outbound connections from WSUS to unknown external servers.
All the detections mentioned above are named in Appendix A: Detection methods.
The following associated detection methods are used by LevelBlue Labs. They can be used by readers to tune or deploy detections in their own environments or for aiding additional research.
The following technical indicators are associated with the reported intelligence.
The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques:
The following list of sources was used by the report author(s) during the collection and analysis process associated with this intelligence report.
LevelBlue Labs rates sources based on the Intelligence source and information reliability rating system to assess the reliability of the source and the assessed level of confidence we place on the information distributed. The following chart contains the range of possibilities, and the selection applied to this report can be found on Page 1.
LevelBlue Labs welcomes feedback about the reported intelligence and delivery process. Please contact the LevelBlue Labs report author or contact alienlabs@intl.att.com.