Deserialization of untrusted data in Windows Server Update Service

CVE-2025-59287 is an unauthenticated deserialization flaw in the WSUS GetCookie() endpoint. The service deserializes an attacker-supplied AuthorizationCookie blob with a legacy BinaryFormatter under the WSUS web service running as SYSTEM (or NETWORK SERVICE with SeImpersonate → SYSTEM), so a single HTTP(S) POST to /ClientWebService/Client.asmx on port 8530/TCP (HTTP) or 8531/TCP (HTTPS) yields remote code execution. Affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025 with the WSUS Server Role enabled — every currently-supported Windows Server SKU shipping WSUS is in scope.

Vendor severity is correct and, if anything, understated in operational terms. Microsoft's original October 14 patch was incomplete; the working out-of-band fix landed October 23. Public PoCs from HawkEye, Huntress, and MDSec dropped within 48 hours, EPSS is pinned at 0.9996, and CISA added it to KEV on October 24 with mass exploitation observed by Eye Security, Huntress, and Sophos. WSUS is by definition a fleet-scale trust anchor — this is not a bug you triage, it is a bug you stop what you are doing for.

Why this verdict

• Unauthenticated network RCE as SYSTEM — no credentials, no user interaction, single SOAP POST. Friction audit: zero prerequisites beyond port reachability.
• Role multiplier — WSUS is a canonical high-value-role component. 100% of installs occupy the update-distribution role by definition. Successful chain ends in arbitrary code push to every domain-joined Windows client polling that WSUS. Floor is CRITICAL; friction cannot pull below.
• KEV-listed with confirmed in-the-wild exploitation starting 2025-10-24 (Eye Security, Huntress, Sophos telemetry). EPSS 0.9996.
• Microsoft's initial Oct 14 patch was incomplete — any org that patched only on Patch Tuesday and stopped there is still vulnerable. This creates a false-sense-of-security population.
• Internal-only deployment does NOT save you — any assumed-breach or phishing beachhead in the corporate LAN reaches WSUS and converts a foothold into fleet takeover.

Why not higher?

9.8 is already the ceiling for network-reachable unauthenticated RCE under CVSS 3.1. There is no CRITICAL+ bucket in this schema.

Why not lower?

Every plausible downgrade lever fails: exploit is trivial, patch adoption is incomplete, exposure is not just external (internal WSUS is the whole point of WSUS), and the blast radius is the entire managed Windows fleet. Downgrading a KEV-listed unauthenticated RCE in a fleet trust anchor would be malpractice.

1. Apply the OOB update KB5070881–KB5070885 immediately — The October 23 out-of-band update is the confirmed fix. The original October 14 update did NOT fully remediate. Deploy within 3 days per the noisgate mitigation SLA — and given active KEV exploitation, treat this as hours, not days.
2. Block inbound TCP 8530/8531 at the perimeter and inter-VLAN — Confirm WSUS is not reachable from the internet with masscan -p8530,8531 <public ranges>. Internally, restrict WSUS ingress to the client subnets that actually poll it via host firewall or NSG rules — no jump-boxes, no DMZ, no admin VLAN if they are not polling clients.
3. Disable the WSUS Server Role on hosts that don't need it — Any Windows Server with Install-WindowsFeature UpdateServices enabled but not actively serving clients is pure attack surface. Uninstall-WindowsFeature UpdateServices -Remove immediately on unused instances.
4. Hunt for post-exploitation indicators back to Oct 14 — Query EDR for w3wp.exe (WsusPool app-pool) spawning cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, or curl.exe since 2025-10-14. Review SUSDB for unexpected update approvals in tbUpdateApproval and unfamiliar package hashes in tbFile.
5. Rotate WSUS service-account and computer-account credentials post-patch — Assume-breach mindset: if the host was reachable and unpatched between Oct 14–23, credential material may be compromised. Rotate the WSUS service account, the computer account (netdom resetpwd), and any SQL sysadmin creds tied to SUSDB.

Run on each Windows Server with the WSUS role as a local administrator. Invoke: powershell.exe -ExecutionPolicy Bypass -File .\Check-CVE-2025-59287.ps1. It inspects the installed KB list and file version of Microsoft.UpdateServices.WebServices.Client.dll and reports VULNERABLE / PATCHED / UNKNOWN.

#requires -RunAsAdministrator
# Check-CVE-2025-59287.ps1 — WSUS deserialization RCE check
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

$ErrorActionPreference = 'Stop'

# Fixed KBs shipped 2025-10-23 (OOB)
$fixedKBs = @('KB5070881','KB5070882','KB5070883','KB5070884','KB5070885')

# Is the WSUS role installed?
try {
    $wsus = Get-WindowsFeature -Name UpdateServices -ErrorAction Stop
    if (-not $wsus.Installed) {
        Write-Host 'NOT_APPLICABLE: WSUS Server Role not installed'
        exit 0
    }
} catch {
    Write-Host 'UNKNOWN: Get-WindowsFeature failed —' $_.Exception.Message
    exit 2
}

# Check installed hotfixes
$installed = Get-HotFix -ErrorAction SilentlyContinue | Select-Object -ExpandProperty HotFixID
$hit = $fixedKBs | Where-Object { $installed -contains $_ }

if ($hit) {
    Write-Host "PATCHED: OOB fix present ($hit)"
    exit 0
}

# Fallback — inspect assembly version of the WSUS client web service DLL
$dll = Join-Path $env:ProgramFiles 'Update Services\WebServices\ClientWebService\bin\Microsoft.UpdateServices.WebServices.Client.dll'
if (Test-Path $dll) {
    $ver = (Get-Item $dll).VersionInfo.FileVersion
    Write-Host "DLL version: $ver"
    # OOB build strings are 10.0.x with revision >= post-Oct-23 build; treat any missing KB as vulnerable
    Write-Host 'VULNERABLE: no fixed KB detected; apply KB5070881–KB5070885 immediately'
    exit 1
} else {
    Write-Host 'UNKNOWN: WSUS DLL path not found'
    exit 2
}

Sources

1. Microsoft MSRC — CVE-2025-59287
2. CISA KEV Catalog
3. NVD entry
4. Huntress — WSUS exploitation writeup
5. Eye Security research
6. Sophos X-Ops
7. FIRST EPSS
8. MDSec advisory