CVE-2026-50328

What it actually does

This vulnerability affects Windows Server Update Services (WSUS) on supported Windows Server and related Windows platforms. It is a network-reachable, unauthenticated flaw caused by an uncaught exception in WSUS request handling. An attacker who can reach the WSUS service can send crafted network traffic that triggers the exception and disrupts WSUS availability. Based on the CVSS vector, the expected impact is denial of service rather than data theft or code execution: confidentiality and integrity are not rated as impacted, while availability is rated high.

Why it matters to the business

A successful attack can interrupt the organization’s ability to distribute Microsoft updates through WSUS, delaying security patch deployment and potentially leaving endpoints and servers exposed to other vulnerabilities. Because WSUS is commonly centralized and supports many downstream Windows systems, an outage can have broad operational impact across patch management, compliance reporting, and vulnerability remediation workflows. The issue is remotely reachable, requires no authentication, and has low attack complexity, but it is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, suggesting lower observed exploitation likelihood at this time compared with widely exploited issues.

How an attack unfolds

An attacker first identifies an exposed WSUS instance, commonly by scanning for WSUS/IIS endpoints on ports such as 8530, 8531, 80, or 443. If the service is reachable, the attacker sends a crafted request to a vulnerable WSUS web service endpoint. The vulnerable component fails to handle the unexpected condition and throws an uncaught exception. Depending on deployment and service recovery behavior, this can cause the WSUS application pool, IIS worker process, or WSUS service functionality to fail or become unavailable. The attacker may repeat the request to sustain the outage, preventing clients and administrators from reliably using WSUS for update synchronization, approvals, reporting, or patch delivery.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows and Windows Server versions, including Windows 10 1607, Windows 10 1809, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 where WSUS is installed or the affected components are present. No fixed version numbers were provided in the input, so use the vendor advisory and Microsoft Update Catalog/Windows Update to identify the applicable cumulative update or security-only update for each operating system. Until patching is complete, restrict network access to WSUS administrative and client-facing endpoints to trusted management networks and expected client networks only, block public Internet exposure, and enforce firewall rules around ports 8530, 8531, 80, and 443 as applicable. Ensure IIS and WSUS service recovery are configured to restart failed services, but treat restart-only measures as mitigation rather than remediation. If WSUS availability is business critical, place the server behind controlled network access and monitor for abnormal request bursts or repeated application pool failures.

How to confirm the fix worked

Confirm that the applicable Microsoft security update is installed on every affected WSUS host by checking Windows Update history, installed hotfixes, Microsoft Update compliance tooling, or enterprise patch management inventory. Validate that WSUS services are healthy after patching by checking the WSUS console, client check-ins, synchronization status, IIS application pool health, and WSUS service status. Confirm that WSUS endpoints are not reachable from untrusted networks by scanning from representative external and internal network locations. Review firewall and load balancer rules to ensure only authorized client and administration segments can access WSUS ports. Where safe and authorized, perform a controlled vulnerability scan using updated scanner content that explicitly checks for this vulnerability or verifies the presence of the relevant Microsoft update.

Typical attack path

1. Scan for reachable WSUS services over the network, especially HTTP/HTTPS WSUS ports such as 8530 and 8531.
2. Fingerprint the service by requesting common WSUS web service paths hosted by IIS.
3. Send a malformed or crafted unauthenticated request that triggers the vulnerable uncaught exception.
4. Cause the WSUS application component or related worker process to fault, recycle, hang, or stop responding.
5. Repeat the request as needed to maintain denial of service and disrupt update distribution.
6. Monitor service behavior externally to determine whether WSUS remains unavailable or repeatedly restarts.

How to detect it

To determine whether exploitation may already have occurred, review IIS access logs for unusual or repeated requests to WSUS web service endpoints, especially from IP addresses that are not expected Windows clients, upstream WSUS servers, downstream WSUS servers, or management systems. Correlate those requests with Windows Application and System event logs for .NET Runtime errors, Application Error events, IIS worker process crashes, WSUS service failures, application pool recycles, or service restarts. Review WSUS logs for synchronization failures, client reporting failures, sudden drops in check-ins, or repeated health check failures around the same timestamps. Key log sources include IIS W3C logs, Windows Application event log, Windows System event log, WSUS server logs, HTTP.sys logs if enabled, endpoint detection telemetry for w3wp.exe and WSUSService.exe, firewall logs, reverse proxy logs, and load balancer access logs. Suspicious patterns include a spike of HTTP 400/500 responses against WSUS paths, repeated access to SOAP/ASMX endpoints by a small number of sources, service crashes immediately after inbound HTTP requests, and recurring restart/failure loops. Because no public exploit maturity or threat actor activity is reported in the input, detections should focus on behavioral evidence rather than known exploit payloads.

• /ClientWebService/client.asmx
• /SimpleAuthWebService/SimpleAuth.asmx
• /ServerSyncWebService/ServerSyncWebService.asmx
• /DssAuthWebService/DssAuthWebService.asmx
• /ApiRemoting30/WebService.asmx
• /ReportingWebService/ReportingWebService.asmx
• /SelfUpdate/
• /Content/
• C:\Program Files\Update Services\LogFiles\SoftwareDistribution.log
• C:\Program Files\Update Services\LogFiles\WSUSCtrl.log
• C:\Program Files\Update Services\LogFiles\Change.log
• C:\inetpub\logs\LogFiles\
• C:\Windows\System32\LogFiles\HTTPERR\
• w3wp.exe
• WSUSService.exe
• WsusService.exe
• WSUSPool
• .NET Runtime
• Application Error
• IIS-W3SVC-WP
• Windows Server Update Services
• Service Control Manager
• The WSUSService service terminated unexpectedly
• A process serving application pool 'WsusPool' suffered a fatal communication error
• HTTP 500
• HTTP 503
• port 8530
• port 8531

What your security team should do

• Prioritize patching WSUS servers and any systems hosting the affected WSUS components, because compromise of update infrastructure can disrupt enterprise-wide patch operations.
• Inventory all WSUS deployments, including upstream, downstream, disconnected, lab, and legacy servers running affected Windows versions.
• Restrict WSUS access to trusted networks and remove any direct Internet exposure of WSUS ports or IIS virtual directories.
• Monitor IIS, Windows Application, System, and WSUS logs for repeated unhandled exceptions, worker process crashes, service restarts, or request bursts to WSUS web service endpoints.
• Create temporary detections for abnormal access to WSUS endpoints from non-client networks, unauthenticated sources, or unusual user agents.
• Confirm service recovery settings for IIS application pools and WSUS-related services, while continuing to treat vendor patching as the required fix.
• After remediation, verify client check-in, update synchronization, approval workflows, and reporting functionality to ensure patch operations have recovered.
• Because the issue is not currently KEV-listed and has low EPSS, handle it as high operational priority for exposed or critical WSUS servers rather than as confirmed active exploitation.