CVE-2025-59287 — Critical unauthenticated RCE in Windows Server Update Services (WSUS) via unsafe deserialization of an AuthorizationCookie, enabling SYSTEM-level compromise and active exploitation; patch or isolate WSUS (ports 8530/8531) immediately.
TL;DR: Microsoft patched a critical unauthenticated remote code execution (RCE) vulnerability in Windows Server Update Services (WSUS) that’s already being exploited in the wild. The issue stems from unsafe deserialization of attacker-controlled data, allowing remote SYSTEM-level compromise. This bug essentially turns your update server — the thing meant to secure your network — into a potential weapon against it. Patch immediately or isolate WSUS until you can.
WSUS is the backbone for distributing Windows updates across many enterprise environments. It allows admins to manage, approve, and deploy updates internally — saving bandwidth and providing central control.
However, a flaw in one of WSUS’s web service endpoints made it possible for attackers to send malicious serialized data disguised as an AuthorizationCookie. When WSUS receives this crafted cookie, it tries to deserialize it without proper validation, leading to arbitrary code execution.
Attackers are using this to run code as SYSTEM, the highest privilege on Windows. Since WSUS servers often sit in trusted network zones and can push updates to every client, this flaw becomes a golden entry point. Once exploited, it could let adversaries deploy , , or . Microsoft released an emergency patch, and CISA added this CVE to the list — a strong signal that threat actors are already on the move.
A proof-of-concept (PoC) quickly surfaced after the patch dropped, confirming how easy exploitation could be once the flow was understood. In essence, the exploit:
Crafts a fake cookie payload (AuthorizationCookie) expected by WSUS, embedding a serialized .NET object instead of genuine authentication data.
Sends this blob to vulnerable ASMX endpoints such as:
/SimpleAuthWebService/SimpleAuthWebService.asmx/ReportingWebService/ReportingWebService.asmxThe server decrypts and blindly deserializes it using outdated .NET BinaryFormatter routines.
The injected object’s gadget chain triggers execution of attacker commands — typically spawning cmd.exe or powershell.exe under SYSTEM.
Since the PoC is now public, opportunistic attackers are actively scanning networks for open WSUS ports. The availability of weaponized payloads makes patching non-negotiable.
Patch immediately — apply Microsoft’s out-of-band WSUS update addressing CVE-2025-59287. Verify installation via the KB number and reboot the system afterward to finalize the fix.
If you can’t patch yet:
Update your defenses:
Below are IoCs and hunt queries you can plug directly into SIEM or EDR platforms to detect possible exploitation.
Ports: TCP 8530 (HTTP), TCP 8531 (HTTPS)
Endpoints hit:
/SimpleAuthWebService/SimpleAuthWebService.asmx/ReportingWebService/ReportingWebService.asmx/ClientWebService/ClientWebService.asmxPayload clues: Unusually large Base64 blobs in cookies or POST bodies labeled AuthorizationCookie.
Behavioral clue: Sudden or irregular POSTs to WSUS from unknown IPs or internal clients that typically don’t check in there.
Suspicious process spawns:
w3wp.exe or wsusservice.execmd.exe or powershell.exeCommand-line traits:
-EncodedCommand, Invoke-Expression, or network callbacks.Persistence signs:
C:\inetpub\logs\LogFiles\W3SVC*\u_ex*.logC:\Program Files\Update Services\LogFiles\SoftwareDistribution.log4103, 41041 for suspicious parent-child process chains# CVE-2025-59287 hunt: detect oversized AuthorizationCookie POSTs to WSUS ASMX endpoints
index=web_logs (uri_path="/SimpleAuthWebService/SimpleAuthWebService.asmx"
OR uri_path="/ReportingWebService/ReportingWebService.asmx"
OR uri_path="/ClientWebService/ClientWebService.asmx")
| where like(Cookie, "%AuthorizationCookie=%")
| where len(Cookie) > 1000
| table _time, clientip, uri_path, Cookie
# CVE-2025-59287 Detection: WSUS spawning PowerShell (potential deserialization RCE)
title: WSUS Process Spawned Suspicious Shell
id: dfd1a2e2-2025-59287-detect
status: stable
description: Detects suspicious behavior where WSUS-related processes (w3wp.exe) spawn PowerShell shells, indicative of CVE-2025-59287 exploitation.
author: Aditya Bhatt
date: 2025/10/28
logsource:
category: process_creation
product: windows
detection:
selection:
EventID: 1
ParentImage|endswith: '\w3wp.exe'
Image|endswith: '\powershell.exe'
condition: selection
fields:
- Image
- ParentImage
- CommandLine
- User
- Computer
falsepositives:
- WSUS administration scripts legitimately using PowerShell (rare)
level: high
tags:
- attack.execution
- cve.2025-59287
- wsus
EQL Version
process where event.code == "1" and
process.parent.name == "w3wp.exe" and
process.name == "powershell.exe"
KQL Version
event.code:1 and process.parent.name:"w3wp.exe" and process.name:"powershell.exe"
Security vendors reacted fast:
/SimpleAuthWebService.asmx.w3wp.exe) as a strong signal of compromise.w3wp.exe → powershell.exe chains. 🕵️♀️Patch fast, hunt deep, and remember — even your security tools can betray you if they’re not patched. 🔒🦉