CVE-2025-59287

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · weaponizedDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 24 exploits · weaponized

Likely / severe?

100.0% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

113 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-10-24remediate by 2025-11-14

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-23

Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedWindows Server 2012msrc_csaf
6.2.9200.25728:Security Update:https://support.microsoft.com/help/5070887
https://support.microsoft.com/help/5070887
FixedWindows Server 2012 (Server Core installation)msrc_csaf
6.2.9200.25728:Security Update:https://support.microsoft.com/help/5070887
https://support.microsoft.com/help/5070887
FixedWindows Server 2012 R2msrc_csaf
6.3.9600.22826:Security Update:https://support.microsoft.com/help/5070886
https://support.microsoft.com/help/5070886
FixedWindows Server 2012 R2 (Server Core installation)msrc_csaf
6.3.9600.22826:Security Update:https://support.microsoft.com/help/5070886
https://support.microsoft.com/help/5070886
FixedWindows Server 2016msrc_csaf
10.0.14393.8524:Security Update:https://support.microsoft.com/help/5070882
https://support.microsoft.com/help/5070882
FixedWindows Server 2016 (Server Core installation)msrc_csaf
10.0.14393.8524:Security Update:https://support.microsoft.com/help/5070882
https://support.microsoft.com/help/5070882
FixedWindows Server 2019msrc_csaf
10.0.17763.7922:Security Update:https://support.microsoft.com/help/5070883
https://support.microsoft.com/help/5070883
FixedWindows Server 2019 (Server Core installation)msrc_csaf
10.0.17763.7922:Security Update:https://support.microsoft.com/help/5070883
https://support.microsoft.com/help/5070883
FixedWindows Server 2022msrc_csaf
10.0.20348.4297:Security Update:https://support.microsoft.com/help/5070884
https://support.microsoft.com/help/5070884
FixedWindows Server 2022 (Server Core installation)msrc_csaf
10.0.20348.4297:Security Update:https://support.microsoft.com/help/5070884
https://support.microsoft.com/help/5070884
FixedWindows Server 2022, 23H2 Edition (Server Core installation)msrc_csaf
10.0.25398.1916:Security Update:https://support.microsoft.com/help/5070879
https://support.microsoft.com/help/5070879
FixedWindows Server 2025msrc_csaf
10.0.26100.6905:Security Update:https://support.microsoft.com/help/5070881
https://support.microsoft.com/help/5070881
FixedWindows Server 2025 (Server Core installation)msrc_csaf
10.0.26100.6905:Security Update:https://support.microsoft.com/help/5070881
https://support.microsoft.com/help/5070881
FixedEcoStruxure™ Foxboro DCS Advisor services installed with Microsoft Windows Server Update Services installed on Microsoft Windows Server 2022 <10.0.20348.4297cisa_csaf_ot
Patch KB5070884 from Microsoft includes a fix for this vulnerability and is available for download directly from WSUS. Reboot may be required to complete patch update. Customers should contact and work with [Global Customer Support](https://pasupport.se.com/home) to verify update has been completed.
FixedEcoStruxure™ Foxboro DCS Advisor services installed with Windows Server Update Services application installed on Microsoft Windows Server 2016 <10.0.14393.8524cisa_csaf_ot
Patch KB5070882 from Microsoft includes a fix for this vulnerability and is available for download directly from WSUS. Reboot may be required to complete patch update. Customers should contact and work with [Global Customer Support](https://pasupport.se.com/home) to verify update has been completed.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Microsoft Security Response Center US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502USCWE-502USCWE-502US

exploits (24)

Public proof-of-concept and weaponised exploit code.

affected products (113)

Products and version ranges known to be affected.

Microsoft Windows 10all versionscert_bundDEcpe:/o:microsoft:windows_10:-
Microsoft Windows 10 Version 1607all versionscert_bundDEcpe:/o:microsoft:windows_10:version_1607
Microsoft Windows 10 Version 1809all versionscert_bundDEcpe:/o:microsoft:windows_10:version_1809
Microsoft Windows 10 Version 21H2all versionscert_bundDEcpe:/o:microsoft:windows_10:version_21h2
Microsoft Windows 10 Version 22H2all versionscert_bundDEcpe:/o:microsoft:windows_10:version_22h2
Microsoft Windows 11 Version 22H2all versionscert_bundDEcpe:/o:microsoft:windows_11:version_22h2
Microsoft Windows 11 Version 23H2all versionscert_bundDEcpe:/o:microsoft:windows_11:version_23h2
Microsoft Windows 11 Version 24H2all versionscert_bundDEcpe:/o:microsoft:windows_11:version_24h2
Microsoft Windows 11 Windows Terminalall versionscert_bundDEcpe:/o:microsoft:windows_11:windows_terminal
Microsoft Windows App Client for Desktopall versionscert_bundDEcpe:/o:microsoft:windows:app_client_for_desktop
Microsoft Windows Remote Desktop Clientall versionscert_bundDEcpe:/o:microsoft:windows:remote_desktop_client_for_desktop
Microsoft Windows Server 2008 R2 SP1all versionscert_bundDEcpe:/o:microsoft:windows_server:2008_r2_sp1
Microsoft Windows Server 2008 SP2all versionscert_bundDEcpe:/o:microsoft:windows_server:2008_sp2
Microsoft Windows Server 2012all versionscert_bundDEcpe:/o:microsoft:windows_server_2012:-
Microsoft Windows Server 2012 R2all versionscert_bundDEcpe:/o:microsoft:windows_server_2012_r2:-
Microsoft Windows Server 2016all versionscert_bundDEcpe:/o:microsoft:windows_server_2016:-
Microsoft Windows Server 2019all versionscert_bundDEcpe:/o:microsoft:windows_server_2019:-
Microsoft Windows Server 2022all versionscert_bundDEcpe:/o:microsoft:windows_server_2022:-
Microsoft Windows Server 2022 23H2 Editionall versionscert_bundDEcpe:/o:microsoft:windows_server_2022:23h2_edition
Microsoft Windows Server 2025all versionscert_bundDEcpe:/o:microsoft:windows_server_2025:-

showing 20 of 113

advisories (4)

Vendor and ecosystem advisories describing this.

NCSC-2025-0310Kwetsbaarheden verholpen in Microsoft WindowsNL2025-10-14csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in Windows.
WID-SEC-W-2025-2307Microsoft Windows: Mehrere SchwachstellenDeutsch2025-10-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Windows Server, Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows 10, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows, Microsoft Windows Server 2022, Microsoft Windows 11 und Microsoft Windows Server 2025 ausnutzen, um Remote Code Execution, Privilegieneskalation, Datenexfiltration oder Systemabstürze zu verursachen.
msrc_CVE-2025-59287Windows Server Update Service (WSUS) Remote Code Execution Vulnerability2025-10-14csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
ICSA-25-352-02Schneider Electric EcoStruxure Foxboro DCS Advisor2025-12-09icsa · cisa_csaf_otUS
Schneider Electric is aware of a vulnerability disclosed by Microsoft in the Microsoft Windows Server Update Services (WSUS) used in the EcoStruxure™ Foxboro DCS Advisor services. The EcoStruxure™ Foxboro DCS Advisor, an optional component of the [EcoStruxure™ Foxboro DCS system](https://www.se.com/ww/en/work/products/industrial-automation-control/foxboro-dcs/), facilitates remote connectivity and diagnostics by continuously monitoring key performance indicators (KPI) on the I/A Series or Control Software system's process. Failure to apply the remediations provided below may risk a potential remote code execution event, which could result in system-level privileges acquired by unauthorized parties.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl msrc_csaf cisa_csaf_ot NVD CVE.org MITRE

published 2025-10-14modified 2026-06-17

references (9)

External citations — patches, advisories, analysis.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 cnnvd
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 enisa_euvd
https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951Third Party Advisorynvd
https://hawktrace.com/blog/CVE-2025-59287ExploitThird Party Advisorynvd
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287Vendor Advisorynvd
https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/Press/Media Coveragenvd
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59287Third Party AdvisoryUS Government Resourcenvd
https://www.vicarius.io/vsociety/posts/cve-2025-59287-detection-script-rce-vulnerability-in-windows-server-update-serviceThird Party Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan