DaystoPatch

MicrosoftExploited incident

WSUS deserialization RCE: Patch Tuesday fix incomplete, out-of-band fix nine days later (CVE-2025-59287)

CVE-2025-59287Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 24 Oct 2025

  • Exploited after a fix existed
FixedFixed for every supported version 9 days after the first public report.

Response

Silence
0h
First public report to first vendor statement
Exposure
9d
First public report to first fix
Follow-through
9d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE-2025-59287 record (CNA: Microsoft)CuratedQuote verified

    "datePublished":"2025-10-14T17:01:47.629Z"

    Published with October 2025 Patch Tuesday.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3277aaaf19501ce3…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    Microsoft advisory CVE-2025-59287ClaimedQuote not found in archive14 Oct 2025

    Windows Server Update Service (WSUS) Remote Code Execution Vulnerability. Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a

    The vendor's own disclosure.

    Source
    Microsoft advisory CVE-2025-59287 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:02d6e3e21beeb842…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-59287ClaimedQuote verified14 Oct 2025, 17:01 UTC

    Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3277aaaf19501ce3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet15 Oct 2025, 02:00 UTC

    2025年10月のパッチチューズデー：Windows Server Update Serviceと古いモデムドライバーの脆弱性

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet20 Oct 2025, 01:30 UTC

    📢 CVE-2025-59287 : RCE non authentifiée avec privilèges SYSTEM dans Microsoft WSUS via désérialisation non sécurisée 📝 Selon HawkTrace, une faille critique CVE-2025-59287 affecte

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    HawkTrace: CVE-2025-59287 WSUS Unauthenticated RCECuratedQuote verified22 Oct 2025

    October 22, 2025

    Public technical write-up and proof of concept ('CVE-2025-59287 — WSUS Unauthenticated Remote Code Execution'), before the out-of-band fix. The page date may reflect an update; Huntress links to it as the PoC reference.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:133a6524a708367e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-59287)ClaimedQuote verified24 Oct 2025

    Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

    Added to CISA's KEV catalog on 2025-10-24.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet24 Oct 2025, 14:25 UTC

    Windows Server emergency patches fix WSUS bug with PoC exploit (CVE-2025-59287)

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE-2025-59287 record (CNA: Microsoft)CuratedQuote verified

    "datePublished":"2025-10-14T17:01:47.629Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3277aaaf19501ce3…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Microsoft advisory CVE-2025-59287ClaimedQuote not found in archive14 Oct 2025

    Windows Server Update Service (WSUS) Remote Code Execution Vulnerability. Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a

    Source
    Microsoft advisory CVE-2025-59287 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:02d6e3e21beeb842…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Microsoft advisory CVE-2025-59287ClaimedQuote verified

    The following workarounds might be helpful in your situation.

    Workaround/Mitigation remediation listed; dated by the first revision

    Source
    Microsoft advisory CVE-2025-59287 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b27e513183ab4720…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date only+9d

    MSRC CVRF document 2025-Oct (CVE-2025-59287 entry)CuratedQuote verified

    To comprehensively address CVE-2025-59287, Microsoft has released an out of band security update for the following supported versions of Windows Server

    CVRF revision 2.0 dated 2025-10-23 (Pacific date). The 2025-10-14 Patch Tuesday update is not counted as a fix: Microsoft's own wording is that the out-of-band update was needed 'to comprehensively address' the CVE, and Horizon3 reports CODE WHITE's finding that the October updates 'inadvertently introduced code that deserializes user-controlled data using SoapFormatter, which is the issue captured by this vulnerability'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b27e513183ab4720…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Microsoft advisory CVE-2025-59287ClaimedQuote verified14 Oct 2025

    Information published.

    Vendor Fix listed at the first revision

    Source
    Microsoft advisory CVE-2025-59287 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b27e513183ab4720…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Microsoft Support KB5070884 (Windows Server 2022)CuratedQuote verified23 Oct 2025

    October 23, 2025—KB5070884 (OS Build 20348.4297) Out-of-band

    Out-of-band KBs dated 2025-10-23 also exist for Server 2016 (KB5070882), 2019 (KB5070883), 23H2 (KB5070879) and 2025 (KB5070881).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3abb21f8afaf8627…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date only+9d

    MSRC CVRF document 2025-Oct (CVE-2025-59287 entry)CuratedQuote verified

    To comprehensively address CVE-2025-59287, Microsoft has released an out of band security update for the following supported versions of Windows Server

    The 2025-10-23 revision lists every supported Windows Server version (2012 through 2025). Hotpatch-enrolled 2022/2025 servers got hotpatch packages on 2025-10-24 (revision 3.0); they could already install the 2025-10-23 update with a reboot.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b27e513183ab4720…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2 and 2025 with the WSUS Server Role enabled
How we built this timeline

Selected as a patch-day exception: the routine inference would date the fix to Patch Tuesday (14 Oct 2025), but Microsoft shipped the effective fix out of band on 23 Oct 2025. Exploitation followed the OOB release by hours: Huntress (24 Oct 2025): 'Starting around 23 Oct 2025 23:34 UTC, Huntress observed threat actors targeting WSUS instances publicly exposed on their default ports (8530/TCP and 8531/TCP)';

CISA added it to KEV on 24 Oct 2025. exploited before a fix=false because no exploitation was reported before the 23 Oct 2025 fix, but note a public PoC existed before that fix. Microsoft's CVRF still shows 'Exploited:No' as of the cached copy.

Workarounds (disable the WSUS role, or block inbound 8530/8531 on the host firewall) are in the CVE entry, but its revision history does not say when they were added, so no Workaround moment is recorded. CVSS 9.8 from Microsoft.

Per CODE WHITE/Horizon3, servers still on September 2025 updates were not affected.

Related

Microsoft report card