SophiaX
🔍
LIVE
· New victim: Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer... — blacknevas· New victim: Riker Danzig Scherer Hyland & Perretti — SilentRansomGroup· New victim: Hightech Signs — kairos· New victim: Riker Danzig LLP — SilentRansomGroup· New victim: gamaus.com — incransom· New KEV: CVE-2026-72898 · Metabase· New KEV: CVE-2026-20349 · Cisco· New KEV: CVE-2026-68820 · Microsoft· New KEV: CVE-2026-8037 · Progress· New KEV: CVE-2026-63077 · JetBrains· New victim: 3,981 new IOCs ingested in last 24h Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer... — blacknevas· New victim: Riker Danzig Scherer Hyland & Perretti — SilentRansomGroup· New victim: Hightech Signs — kairos· New victim: Riker Danzig LLP — SilentRansomGroup· New victim: gamaus.com — incransom· New KEV: CVE-2026-72898 · Metabase· New KEV: CVE-2026-20349 · Cisco· New KEV: CVE-2026-68820 · Microsoft· New KEV: CVE-2026-8037 · Progress· New KEV: CVE-2026-63077 · JetBrains· 3,981 new IOCs ingested in last 24h
← Vulnerabilities

CVE-2025-59287

⚡ CISA KEV
Published: —Modified: —Vendor: MicrosoftProduct: Windows
—
CVSS v3
99.9%
EPSS
⚡ Added to KEV on 2025-10-24 · Federal agencies must remediate by 2025-11-14
Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.
💣 Public Exploits0
From Exploit-DB
No public exploits in Exploit-DB.
🔍 Sigma Detection Rules2
Rules tagged with this CVE
highExploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Processwindows—
highExploitation Activity of CVE-2025-59287 - WSUS Deserializationwindows—
🛠️ Patch Details11
Affected/fixed versions from threat intel reports
Microsoft Windows Serversource ↗
Microsoft Windows Server Update Services (WSUS)——source ↗
Microsoft Windows Server Update Services (WSUS)——source ↗
Microsoft Windows Server 2019source ↗
Microsoft Windows Server 2022source ↗
Microsoft Windows Server 2012source ↗
Microsoft Windows Server Update Services——source ↗
Microsoft Windows Server 2025source ↗
Microsoft Windows Server 2012 R2source ↗
Microsoft Windows Server 2016source ↗
Microsoft Windows Server Update Servicessource ↗
📰 Threat Intel Coverage15
Digest reports mentioning this CVE
How We Added WebAuthn to a Browser-Based RDP Clientunit422026-07-02
Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix | Huntresshuntress2026-06-02
Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Toolsunit422026-05-11
Gladinet CentreStack/Triofox: Cryptography Vulnerability | Huntresshuntress2025-12-18
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntresshuntress2025-12-03
Velociraptor WSUS Exploitation, Pt. I: WSUS-Up? | Huntresshuntress2025-11-20
WSUS Deserialization RCE Under Active Exploitation (CVE-2025-59287)hawkeye2025-10-31
The Bug Report - October 2025 Editiontrellix2025-10-31
Exploitation of Windows Server Update Services Remote Code | Huntresshuntress2025-10-24
Active Exploitation of Gladinet CentreStack and Triofox | Huntresshuntress2025-10-15
Wing FTP Server RCE (CVE-2025-47812) Exploited in the Wild | Huntresshuntress2025-07-10
Post-Exploitation Activities Observed from the Samsung | Huntresshuntress2025-05-09
CVE-2025-30406: Gladinet CentreStack & Triofox Exploited | Huntresshuntress2025-04-14
CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation | Huntresshuntress2025-04-04
Critical Vulnerabilities: WS_FTP Exploitation | Huntresshuntress2023-10-02
📎 References0
No reference URLs.