esteban11121/wsus-rce-mitigation-59287Guía de respuesta rápida y script de auditoría para CVE-2025-59287 (RCE crítica en WSUS).
CREATOR AND CREDITS: (@esteban11121) This guide has been created to help the community quickly mitigate the vulnerability.
STATUS: Active Exploitation (In-the-Wild) Confirmed.
This is a Remote Code Execution (RCE) vulnerability affecting WSUS servers, allowing unauthenticated attackers to obtain SYSTEM privileges. Immediate Out-of-Band (OOB) patching action is required.
| Detail | Value |
|---|
| Identifier | CVE-2025-59287 |
| CVSS Severity | 9.8 (Critical) |
| Attack Vector | Network (Remote, unauthenticated execution) |
| Affected Services | Windows Server Update Services (WSUS) |
| Required Action | OOB Patching and Reboot |
ONLY Windows servers with the WSUS Server Role (Windows Server Update Services) ENABLED are at risk.
| Windows Server Version | Vulnerability Status |
|---|---|
| Server 2025 | Vulnerable |
| Server 2022 | Vulnerable |
| Server 2019 | Vulnerable |
| Server 2016 | Vulnerable |
| Server 2012 / 2012 R2 | Vulnerable |
The goal is to secure vulnerable systems before applying the OOB update.
Identify Servers: Confirm the exact list of all servers running the WSUS Role.
Emergency Mitigation (If Patching is not Instantaneous):
Verification: Confirm that ports 8530/8531 are no longer accessible from unauthorized sources.
SSU (Servicing Stack Update) Verification:
Download the Correct OOB KB:
| Windows Server Version | Security Update Package (KB ID) |
|---|---|
| Server 2025 | KB5070885 |
| Server 2022 | KB5070884 |
| Server 2019 | KB5070883 |
| Server 2016 | KB5070882 |
| Server 2012 R2 | KB5070881 |
| Server 2012 | KB5070880 |
If you need to confirm whether the vulnerable component is actually listening and accessible, run this command in PowerShell to verify the ports used by the WSUS web service:
# Verification of WSUS listening ports (Attack vector)
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -eq 8530 -or $_.LocalPort -eq 8531 }