Product
Windows Server Update Services
- First Reported
- Oct 24, 2025
- Latest Reported
- Oct 13, 2026
Reported Context (5)
- In the final stages, the intruder attempted to expand control by exploiting a Windows Server Update Services (WSUS) remote code execution vulnerability on the central configuration management server. Third-Party VPN Access Enabled a Months-Long Intrusion at a European Bank
- However, this doesn't apply to devices that receive updates from Windows Server Update Services (WSUS), which downloads updates and distributes them across enterprise networks. Unsupported Windows Devices Will Lose Access to Security Updates in 2027
- We recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor. Huntress Details Three Intrusions Abusing Velociraptor for Command-and-Control
- threat actors likely exploited a recently patched remote code execution vulnerability in Windows Server Update Services (WSUS). After gaining initial access via exploitation of the flaw (CVE-2025-59287), the Attackers Exploit WSUS Flaw to Install Velociraptor for Remote Access
- HomeBlogExploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287) Attackers Exploit WSUS Remote Code Execution Vulnerability CVE-2025-59287
CVE (5)
Malware (1)
People (14)
Threat Actors (1)
MITRE ATT&CK (17)
Vendors (3)
Products (13)
Tools (3)
Industries (2)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.