WSUS RCE (CVE-2025-59287) — Proof-of-Concept Out, Active Scanning Observed

A critical remote code execution (RCE) vulnerability — CVE-2025-59287 — has been discovered in Windows Server Update Services (WSUS).
The flaw impacts servers configured with the WSUS Server role acting as an update source for other WSUS servers (❗ not enabled by default).

Despite limited exposure, threat actors are now actively scanning and exploiting the flaw, following the release of public proof-of-concept (PoC) exploit code.

---

Why This Matters

• Remote code execution with SYSTEM privileges — no user interaction or authentication required.
• Low-complexity exploitation and potentially wormable behavior between WSUS servers.
• PoC exploit is publicly available, accelerating attacks and scanning activity.
• Confirmed exploitation by Eye Security and Huntress Labs, observed since October 24, 2025.

---

Who’s Affected

• Servers with WSUS Server role configured as upstream update sources.
• Systems with ports 8530 (HTTP) or 8531 (HTTPS) are exposed to the Internet.
• According to Eye Security and Huntress:
  • 🌍 ~2,500 WSUS instances exposed worldwide
  • 🇩🇪 ~250 in Germany, 🇳🇱 ~100 in the Netherlands

Huntress reported attackers executing PowerShell reconnaissance commands and exfiltrating results via webhooks:

whoami
net user /domain
ipconfig /all

---

Immediate Actions

1️⃣ Patch Immediately

Microsoft released out-of-band security updates for all affected Windows Server versions — install ASAP:

• Windows Server 2025 — KB5070881
• Windows Server, version 23H2 — KB5070879
• Windows Server 2022 — KB5070884
• Windows Server 2019 — KB5070883
• Windows Server 2016 — KB5070882
• Windows Server 2012 R2 — KB5070886
• Windows Server 2012 — KB5070887

2️⃣ If You Can’t Patch Immediately

• ❌ Disable the WSUS Server role on affected systems.
• 🔒 Block inbound connections on ports 8530 / 8531 at firewalls or gateways.
• 🕵️ Monitor for suspicious PowerShell or HTTP traffic from WSUS hosts.

3️⃣ Detection & Investigation

• Search for:
  • whoami, net user /domain, ipconfig /all executed unexpectedly.
  • Outbound HTTP POST traffic to unknown or external domains (potential data exfiltration).

---

Official Advisories & Research

• Microsoft: CVE-2025-59287 (Exploitation More Likely)
• Eye Security: Active exploitation confirmed
• Huntress Labs: Observed reconnaissance and data collection activity
• NCSC-NL: Confirmed exploitation in the wild

---

Alcaeus Services Recommendation

This is a high-priority, actively exploited RCE with public PoC code — patching is critical.
Even though WSUS is not typically exposed online, internal lateral movement via chained attacks is possible.

At Alcaeus Services, we recommend:

• 🚀 Immediate patch orchestration across WSUS environments
• 🧰 Threat hunting for early indicators of compromise
• 🧱 WSUS hardening and network segmentation to limit future exposure
• 🔍 Continuous vulnerability monitoring with automated patch validation