Windows Server Update Services (WSUS) CVE-2025-59287 (CVSS 9.8, unauthenticated RCE, exploited, CISA KEV): which update fixes it and what if I can't patch yet?

What it is: CVE-2025-59287 is an unsafe deserialization flaw in Windows Server Update Services. An unauthenticated attacker who can reach the WSUS web service (default ports 8530/TCP HTTP and 8531/TCP HTTPS) can run code as SYSTEM on the WSUS server. The October 2025 Patch Tuesday fix was incomplete; Microsoft shipped an out-of-band update on October 23, 2025, attacks against internet-exposed WSUS servers began right after, and CISA added it to the Known Exploited Vulnerabilities catalog on October 24, 2025. Am I affected: - Windows Server 2012 / 2012 R2, 2016, 2019, 2022 and 2025 with the WSUS Server Role enabled, without the October 23, 2025 out-of-band update or a later cumulative update. Servers without the WSUS role are not exposed to this bug. - Check: Server Manager or Get-WindowsFeature -Name UpdateServices to see if the role is installed; check installed updates against Microsoft's CVE page for your OS version; and check whether ports 8530/8531 are reachable from the internet or untrusted networks. Fix: 1. Install the out-of-band update from October 23, 2025 or any later cumulative update for your Windows Server version, then reboot the WSUS server (the fix isn't complete until it restarts). 2. If you can't patch right away: disable the WSUS Server Role, or block inbound traffic to TCP 8530 and 8531 at the host firewall. Either stops the server from receiving updates for clients until undone. 3. WSUS should never be reachable from the internet; restrict it to the internal clients that need it. After: look for signs of exploitation since October 2025: unexpected child processes of w3wp.exe or WsusService.exe (cmd.exe, powershell.exe), new accounts or scheduled tasks, and outbound connections from the WSUS server. If found, treat the server, and possibly the update distribution it controls, as compromised. Sources: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 https://www.helpnetsecurity.com/2025/10/24/wsus-vulnerability-cve-2025-59287-exploited/ https://beazley.security/alerts-advisories/critical-microsoft-wsus-vulnerability-being-exploited-in-the-wild-cve-2025-59287