Hackers exploiting crucial vulnerability in Windows Server Update Service

Security researchers are warning that cyber menace actors are abusing a crucial vulnerability in Microsoft Windows Server Update Service. 

The vulnerability, tracked as CVE-2025-59287, entails deserialization of untrusted knowledge and will permit intruders to execute code with out authorization.

Researchers at Huntress stated they’ve seen attackers exploiting the vulnerability in 4 completely different clients’ networks. 

Senior safety researcher John Hammond described the assault as a easy “point-and-shoot” method, noting that the current launch of a proof of idea made the assault trivially accessible for any hacker to launch. 

Microsoft issued out-of-band security updates on Thursday to handle the vulnerability. “We rereleased this CVE after identifying that the initial update did not fully mitigate the issue,” a Microsoft spokesperson informed Cybersecurity Dive. 

Experts urged organizations to right away apply the brand new patch.

“The currently trending WSUS vulnerability is a critical issue that should receive top priority for patching in any environment,” Jimi Sebree, senior safety researcher at Horizon3.ai, informed Cybersecurity Dive. “Its presence is due to how juicy of a target the service is.”

Hackers who compromise the service can transfer laterally inside a system and procure vital extra entry, Sebree stated.

The Windows Server Update Service allows IT administrators to manage the deployment of Microsoft product updates throughout their laptop methods. 

The Cybersecurity and Infrastructure Security Agency on Friday added the vulnerability to its Known Exploited Vulnerabilities catalog.

In an advisory released late Friday, CISA urged customers to establish servers which are susceptible to exploitation and instantly apply the upgrades. These servers have WSUS Server Role enabled and ports open to 8530/8531, in line with CISA.

Researchers at Arctic Wolf stated they had been tracking a threat campaign that could be associated to the vulnerability, though they stated they may not verify a hyperlink