Attackers Exploit WSUS Remote Code Execution Vulnerability CVE-2025-59287
Summary
Huntress observed attackers exploiting CVE-2025-59287 against WSUS instances exposed on ports 8530 and 8531 at four customers. Attackers ran PowerShell to enumerate systems and send results to a remote webhook; Microsoft released an update.
Key points
- Huntress reported exploitation starting around October 23, 2025, across four customers, targeting publicly exposed WSUS instances on TCP ports 8530 and 8531.
- Attackers sent crafted POST requests to WSUS web services to exploit the AuthorizationCookie deserialization vulnerability.
- Observed process chains showed WSUS service or IIS worker processes launching Command Prompt and PowerShell.
- A decoded PowerShell payload enumerated domain users and system/network information, then sent the results to a remote webhook.
- Huntress observed proxy networks used during exploitation and estimated about 25 susceptible hosts across its partner base.
- Microsoft released an out-of-band update; Huntress advised applying the update and restricting inbound WSUS access to required systems.
Article Details
- Vulnerability Types
- Deserialization remote code execution
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict WSUS access to required management hosts and Microsoft Update servers; block other inbound traffic to TCP ports 8530 and 8531.
MITRE ATT&CK
T1033 · System Owner/User DiscoveryThe observed enumeration commands included whoami and net user /domain to gather user and domain information.T1041 · Exfiltration Over C2 ChannelThe payload sent enumerated network and user information to a remote webhook using HTTP PUT or curl.T1059.001 · PowerShellAttackers executed PowerShell from cmd.exe spawned by w3wp.exe or wsusservice.exe.T1082 · System Information DiscoveryThe PowerShell payload ran ipconfig /all to enumerate system and network information.T1190 · Exploit Public-Facing ApplicationAttackers exploited the remotely exposed WSUS service through crafted POST requests to trigger deserialization RCE.
CVE
People
Chad HudsonNamed author of the Huntress investigation.Jai MintonNamed author of the Huntress investigation.James MaclachlanNamed author of the Huntress investigation.John HammondNamed author of the Huntress investigation.Jordan SextonAcknowledged for contributions to the investigation and writeup.Joshua KiriakoffAcknowledged for contributions to the investigation and writeup.Lindsey O'Donnell-WelchNamed author of the Huntress investigation.Luke WilkinsonAcknowledged for contributions to the investigation and writeup.