Every CVE Search/ Get API key

CVE-2025-59287

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

9.8 CriticalIn KEVPublic exploit

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 99.7 points since Oct 15, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.8

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Record
CVE-2025-59287
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2025-34268 9.8

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Record
EUVD-2025-34268
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-943j-4893-6rfq 9.8

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized...

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Record
GHSA-943j-4893-6rfq
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
CISA KEV No score

Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.

Record
CVE-2025-59287
Weakness
CWE-502
Updated
2026-11-02
NVD 9.8

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Record
CVE-2025-59287
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02

Affected products

Show 2 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitWindows Server Update Service Deserialization Remote Code Execution2025-10-14
PoC in GitHubDaddyBigFish/CVE-2025-59287-hawktrace2025-10-25
PoC in GitHubgarvitv14/CVE-2025-592872025-10-25
PoC in GitHubjiansiting/CVE-2025-592872025-10-25
PoC in GitHub0xBruno/WSUSploit.NET2025-10-26
PoC in GitHubFurkanKAYAPINAR/CVE-2025-592872025-10-27
PoC in GitHubLupovis/Honeypot-for-CVE-2025-59287-WSUS2025-10-27
PoC in GitHubRadzaRr/WSUSResponder2025-10-27
PoC in GitHubmubix/Find-WSUS2025-10-27
PoC in GitHubtecxx/CVE-2025-59287-WSUS2025-10-27
Show 15 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubAdityaBhatt3010/CVE-2025-59287-When-your-patch-server-becomes-the-attack-vector2025-10-28
PoC in GitHubesteban11121/WSUS-RCE-Mitigation-592872025-10-28
PoC in GitHubmrk336/Breaking-the-Update-Chain-Inside-CVE-2025-59287-and-the-WSUS-RCE-Threat2025-10-28
PoC in GitHubfsanzmoya/wsus_CVE-2025-592872025-10-29
PoC in GitHub0x7556/CVE-2025-592872025-10-30
PoC in GitHubQurtiDev/WSUS-CVE-2025-59287-RCE2025-11-01
PoC in GitHubM507/CVE-2025-59287-PoC2025-11-16
PoC in GitHubAdel-hx0d/cve-2025-592872025-11-21
PoC in GitHubgud425/gud425.github.io2025-12-26
PoC in GitHubMaxymGorn/cve-2025-59287-exploit-poc2026-01-08
PoC in GitHubLuemmelSec/CVE-2025-59287---WSUS-SCCM-RCE2026-01-16
PoC in GitHubross-ns/WSUS-CVE-2025-592872026-02-18
PoC in GitHubswoon69/CVE-2025-59287-Exercise-Use2026-03-09
PoC in GitHubowaset55-crypto/CVE-2025-592872026-07-23
NucleiWindows Server Update Service - Insecure Deserialization

History

History
RecordedChangedSources
exploitation
exploits
exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-59287 is a critical vulnerability (CVSS 9.8) in Microsoft Windows, published October 14, 2025. CISA lists it as known to be exploited, since October 24, 2025. EUVD reports exploitation since October 24, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open