CVE-2025-59287

What it actually does

CVE-2025-59287 is a critical deserialization-of-untrusted-data vulnerability in Windows Server Update Services (WSUS). A remote, unauthenticated attacker can send crafted network data to a vulnerable WSUS service and cause the server to deserialize attacker-controlled content, resulting in arbitrary code execution in the context of the WSUS/IIS service account. Because WSUS commonly runs on Windows Server and is trusted to distribute update metadata across many enterprise systems, successful exploitation can provide a high-value foothold for lateral movement, malware staging, update-channel abuse, and domain-adjacent compromise.

Why it matters to the business

Successful exploitation can give an attacker control of a WSUS server, a system that many organizations rely on to manage Windows patching. Compromise of this service can disrupt patch operations, enable malware distribution through a trusted update-management path, and create a platform for broad internal movement. The risk is urgent: the vulnerability is in CISA KEV, has active in-the-wild exploitation, has an extremely high EPSS score of 0.99859, and the CISA remediation due date of 2025-11-14 has passed. Reported exploitation activity includes ShadowPad malware distribution via WSUS, increasing concern for espionage or persistent access operations.

How an attack unfolds

An attacker first identifies an exposed WSUS instance, typically by finding WSUS-related IIS endpoints listening over HTTP or HTTPS. The attacker then sends a specially crafted request containing malicious serialized data to a vulnerable WSUS web service. When the WSUS service processes the request, it deserializes attacker-controlled content and executes code on the server. After code execution, the attacker commonly establishes persistence, drops tooling or malware, enumerates the Windows domain and WSUS configuration, harvests credentials or service-account tokens available to the compromised process, and attempts lateral movement. In observed threat context, exploitation has been associated with ShadowPad malware distribution via WSUS, so defenders should treat confirmed exploitation as a potential broader intrusion rather than an isolated web-service event.

How to fix it

Apply the Microsoft security update that fixes CVE-2025-59287 immediately on all WSUS servers; use the October 2025 Patch Tuesday or later cumulative/security updates applicable to the installed Windows Server version. Because no specific affected-product list or fixed-version list was provided, administrators should validate applicability through Microsoft Security Update Guide, Windows Update, WSUS/SCCM catalogs, or enterprise patch-management tooling. If immediate patching is not possible, restrict network access to WSUS endpoints to only approved management and client subnets, block internet exposure, enforce firewall rules for ports 8530/8531/80/443 as applicable, require TLS where supported, monitor and limit IIS/WSUS service-account privileges, and isolate WSUS servers from high-value administrative systems. Treat mitigation as temporary; patching is required because the issue allows unauthenticated remote code execution.

How to confirm the fix worked

Confirm that each WSUS server has the Microsoft security update containing the fix installed and that Windows Server build numbers, installed KBs, and patch-management inventory reflect the corrected level. Verify that WSUS IIS endpoints are not exposed to the internet and are reachable only from expected internal networks. Review firewall rules for WSUS ports, validate IIS bindings, and confirm that legacy or duplicate WSUS instances have also been patched. Run authenticated vulnerability scans or Microsoft Defender/Vulnerability Management checks where available. After patching, restart affected services or the server if required, confirm WSUS synchronization and client check-in still function, and re-run scans to ensure the vulnerability no longer appears.

Typical attack path

1. Scan for WSUS servers or WSUS IIS endpoints exposed on common WSUS ports such as 8530, 8531, 80, or 443.
2. Send crafted unauthenticated network requests to a vulnerable WSUS web service endpoint that triggers unsafe deserialization.
3. Achieve remote code execution under the WSUS/IIS service context, commonly involving w3wp.exe or WSUS-related service processes.
4. Run reconnaissance commands to identify host privileges, domain membership, update-server configuration, and reachable internal systems.
5. Drop a payload, web shell, loader, or remote-access malware, potentially including ShadowPad in observed campaigns.
6. Establish persistence through services, scheduled tasks, startup locations, or modified web/application files.
7. Use the compromised WSUS server as a trusted internal foothold for credential access, lateral movement, malware staging, or update-channel abuse.

How to detect it

Investigate for prior exploitation using IIS logs, HTTPERR logs, Windows Security logs, PowerShell logs, Sysmon or EDR telemetry, WSUS logs, service-control logs, scheduled-task logs, and network flow records. Focus on inbound requests to WSUS web service endpoints from unexpected sources, especially external IPs or non-client systems, followed by IIS worker-process crashes, 500-series errors, or unusual process creation. Hunt for w3wp.exe, WsusService.exe, or other WSUS/IIS processes spawning command shells, PowerShell, script interpreters, certutil, bitsadmin, curl, rundll32, regsvr32, mshta, or archive tools. Review recent file writes under WSUS/IIS application directories, Windows temporary directories, ProgramData, and user profile temp locations. Look for new or modified services, scheduled tasks, firewall rules, local users, remote-access tools, and unusual outbound connections from the WSUS server. Because reported activity includes ShadowPad malware distribution via WSUS, also hunt for unknown DLL side-loading chains, suspicious signed-binary proxy execution, encrypted outbound C2 traffic, and persistence created shortly after suspicious WSUS web requests.

• /ClientWebService/client.asmx
• /ReportingWebService/ReportingWebService.asmx
• /SimpleAuthWebService/SimpleAuth.asmx
• /ServerSyncWebService/ServerSyncWebService.asmx
• /DssAuthWebService/DssAuthWebService.asmx
• /ApiRemoting30/WebService.asmx
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> curl.exe
• WsusService.exe -> cmd.exe
• WsusService.exe -> powershell.exe
• WsusService.exe -> rundll32.exe
• C:\Program Files\Update Services\LogFiles\SoftwareDistribution.log
• C:\Program Files\Update Services\WebServices\
• C:\Windows\System32\inetsrv\w3wp.exe
• C:\inetpub\logs\LogFiles\
• ShadowPad

What your security team should do

• Treat this as an emergency remediation item because it is KEV-listed, actively exploited in the wild, has EPSS 0.99859, and the CISA due date has passed.
• Inventory all WSUS servers, including test, legacy, disconnected, and downstream replica servers, and patch them with the Microsoft update that fixes CVE-2025-59287.
• Immediately remove any internet exposure of WSUS services and restrict access to approved client networks and administrative hosts only.
• Perform threat hunting on WSUS servers for suspicious IIS requests, abnormal child processes from w3wp.exe or WsusService.exe, new services, scheduled tasks, web artifacts, and malware loaders.
• If exploitation is suspected, isolate the WSUS server, preserve forensic evidence, rotate credentials used on or by the server, and investigate lateral movement from the host.
• Review WSUS trust boundaries and ensure the WSUS server is not over-privileged, is separated from domain administration workflows, and is monitored as a Tier-0-adjacent infrastructure component.
• Add SIEM detections for WSUS web-service requests from unexpected sources and for command interpreters, scripting engines, or network tools spawned by IIS/WSUS processes.