Full Report
Huntress has observed threat actors exploiting a Microsoft Windows Server Update Services (WSUS) vulnerability (CVE-2025-59287).
Analysis Summary
# Vulnerability: Windows Server Update Services (WSUS) Unauthenticated RCE
## CVE Details
- **CVE ID:** CVE-2025-59287
- **CVSS Score:** 9.8 (Critical - *estimated based on RCE impact*)
- **CWE:** CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** Microsoft Windows Server Update Services (WSUS)
- **Versions:** All versions prior to the October 23, 2025 out-of-band update.
- **Configurations:** Systems where WSUS is publicly exposed via default ports **8530/TCP** (HTTP) and **8531/TCP** (HTTPS).
## Vulnerability Description
This is a deserialization vulnerability located within the `AuthorizationCookie` handling mechanism of WSUS web services. Attackers can send specially crafted POST requests to WSUS `.asmx` endpoints. When the server processes the malicious `AuthorizationCookie`, it triggers a flaw in how the `System.Data.DataSet` or related objects are deserialized, allowing for unauthenticated Remote Code Execution (RCE) in the context of the WSUS service or the IIS worker process.
## Exploitation
- **Status:** Exploited in the wild. Multiple organizations have been targeted by threat actors using proxy networks to obfuscate their origin.
- **Complexity:** Low (Unauthenticated)
- **Attack Vector:** Network
- **PoC Availability:** Public (Referenced via Hawktrace research)
## Impact
- **Confidentiality:** High (Full data access and credential theft via PowerShell enumeration)
- **Integrity:** High (Unauthorized command execution and system modification)
- **Availability:** High (Potential for service disruption or full system takeover)
## Remediation
### Patches
- Apply the Microsoft **Out-of-Band (OOB) update** released on **October 23, 2025**. Admins should check the Microsoft Security Update Guide for specific KB numbers corresponding to their Windows Server version.
### Workarounds
- **Network Filtering:** Immediately restrict access to ports 8530/TCP and 8531/TCP. These should never be exposed to the public internet; access should be restricted to known internal assets or via VPN/IP allowlisting.
- **Disable WSUS:** If the service is not strictly necessary, disable the WSUS role and stop the associated IIS sites.
## Detection
### Indicators of Compromise (IoCs)
- **Log Files:**
- Check `C:\Program Files\Update Services\Logfiles\SoftwareDistribution.log` for deserialization error traces (e.g., `System.Data.DataSet.DeserializeDataSetSchema`).
- Check `C:\inetpub\logs\LogFiles\W3SVC*` for suspicious POST requests to:
- `/ReportingWebService/ReportingWebService.asmx`
- `/SimpleAuthWebService/SimpleAuth.asmx`
- `/ClientWebService/Client.asmx`
- **Process Chains:** Monitor for the following parent-child process anomalies:
- `wsusservice.exe` -> `cmd.exe` -> `powershell.exe`
- `w3wp.exe` (specifically the WSUS pool) -> `cmd.exe` -> `powershell.exe`
- **Behavior:** Look for base64-encoded PowerShell payloads performing network enumeration or sending data to external webhooks.
## References
- **Vendor Advisory:** [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287)
- **NVD Detail:** [https://nvd.nist.gov/vuln/detail/CVE-2025-59287](https://nvd.nist.gov/vuln/detail/CVE-2025-59287)
- **Huntress Analysis:** [https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability](https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability)
- **Hawktrace PoC Research:** [https://hawktrace.com/blog/CVE-2025-59287-UNAUTH](https://hawktrace.com/blog/CVE-2025-59287-UNAUTH)