【Vulnerability Alert】A high-risk security vulnerability (CVE-2025-59287) has been identified in Windows Server Update Services. Please verify and apply the necessary patches as soon as possible.

publish date : 2025-10-31 update date : 2025-10-31

Source: Ministry of education information & communication security contingency platform

"" "" ""


Publication Number	TACERT-ANA-2025102901100000	Publication Time	2025/10/29 13:10
Incident Type	ANA-Vulnerability Alert	Discovery Time	2025/10/29 13:10
Impact Level	Medium
[Subject] 【Vulnerability Alert】A high-risk security vulnerability (CVE-2025-59287) has been identified in Windows Server Update Services. Please verify and apply the necessary patches as soon as possible.
[Content] Forwarded from the National Institute of Cyber Security NISAC-200-202510-00000233 Researchers have discovered an insecure deserialization vulnerability (CVE-2025-59287) in Windows Server Update Services (WSUS). An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted events to a WSUS server, enabling arbitrary code execution with system privileges. This vulnerability has already been exploited by attackers. Please verify and apply the necessary security patches as soon as possible. Information Sharing Level: WHITE (Information content can be publicly disclosed)
[Affected Platform] ● Windows Server 2025 (Server Core installation) ● Windows Server 2025 ● Windows Server 2022, 23H2 Edition (Server Core installation) ● Windows Server 2022 (Server Core installation) ● Windows Server 2022 ● Windows Server 2019 (Server Core installation) ● Windows Server 2019 ● Windows Server 2016 (Server Core installation) ● Windows Server 2016 ● Windows Server 2012 R2 (Server Core installation) ● Windows Server 2012 R2 ● Windows Server 2012 (Server Core installation) ● Windows Server 2012
[Recommended Actions] The vendor has released official patches for this vulnerability. Please refer to the official advisory for update instructions at the following URL: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
[Reference] 1. https://nvd.nist.gov/vuln/detail/CVE-2025-59287 2. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 3. https://www.cisa.gov/news-events/alerts/2025/10/24/microsoft-releases-out-band-security-update-mitigate-windows-server-update-service-vulnerability-cve 4. https://www.helpnetsecurity.com/2025/10/24/wsus-vulnerability-cve-2025-59287-exploited/

(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw

Organizer: Computer Center

Click Num:

Share