SophiaX
🔍
LIVE
· New victim: cipher.systems — m3rx· New victim: International Chemical Co. — Barracuda· New victim: M****n — payoutsking· New victim: Applied Composites — Storm· New victim: Magna Legal Services — Storm· New KEV: CVE-2026-65660 · Microsoft· New KEV: CVE-2026-87902 · WordPress· New KEV: CVE-2026-67279 · MikroTik· New KEV: CVE-2026-71362 · Adobe· New KEV: CVE-2026-5430 · WSO2· New victim: 6,898 new IOCs ingested in last 24h cipher.systems — m3rx· New victim: International Chemical Co. — Barracuda· New victim: M****n — payoutsking· New victim: Applied Composites — Storm· New victim: Magna Legal Services — Storm· New KEV: CVE-2026-65660 · Microsoft· New KEV: CVE-2026-87902 · WordPress· New KEV: CVE-2026-67279 · MikroTik· New KEV: CVE-2026-71362 · Adobe· New KEV: CVE-2026-5430 · WSO2· 6,898 new IOCs ingested in last 24h
← Vulnerabilities

CVE-2025-59287

⚡ CISA KEV
Published: —Modified: —Vendor: MicrosoftProduct: Windows
—
CVSS v3
100.0%
EPSS
⚡ Added to KEV on 2025-10-24 · Federal agencies must remediate by 2025-11-14
Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.
💣 Public Exploits0
From Exploit-DB
No public exploits in Exploit-DB.
🔍 Sigma Detection Rules2
Rules tagged with this CVE
highExploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Processwindows—
highExploitation Activity of CVE-2025-59287 - WSUS Deserializationwindows—
🛠️ Patch Details11
Affected/fixed versions from threat intel reports
Microsoft Windows Serversource ↗
Microsoft Windows Server Update Services (WSUS)——source ↗
Microsoft Windows Server Update Services (WSUS)——source ↗
Microsoft Windows Server 2019source ↗
Microsoft Windows Server 2022source ↗
Microsoft Windows Server 2012source ↗
Microsoft Windows Server Update Services——source ↗
Microsoft Windows Server 2025source ↗
Microsoft Windows Server 2012 R2source ↗
Microsoft Windows Server 2016source ↗
Microsoft Windows Server Update Servicessource ↗
📰 Threat Intel Coverage15
Digest reports mentioning this CVE
How We Added WebAuthn to a Browser-Based RDP Clientunit422026-07-02
Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix | Huntresshuntress2026-06-02
Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Toolsunit422026-05-11
Gladinet CentreStack/Triofox: Cryptography Vulnerability | Huntresshuntress2025-12-18
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntresshuntress2025-12-03
Velociraptor WSUS Exploitation, Pt. I: WSUS-Up? | Huntresshuntress2025-11-20
WSUS Deserialization RCE Under Active Exploitation (CVE-2025-59287)hawkeye2025-10-31
The Bug Report - October 2025 Editiontrellix2025-10-31
Exploitation of Windows Server Update Services Remote Code | Huntresshuntress2025-10-24
Active Exploitation of Gladinet CentreStack and Triofox | Huntresshuntress2025-10-15
Wing FTP Server RCE (CVE-2025-47812) Exploited in the Wild | Huntresshuntress2025-07-10
Post-Exploitation Activities Observed from the Samsung | Huntresshuntress2025-05-09
CVE-2025-30406: Gladinet CentreStack & Triofox Exploited | Huntresshuntress2025-04-14
CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation | Huntresshuntress2025-04-04
Critical Vulnerabilities: WS_FTP Exploitation | Huntresshuntress2023-10-02
📎 References0
No reference URLs.