Skip to main content

CISA issues update to address Windows Server Update Service remote code execution vulnerability

Source Decision Insights Threat Desk Published November 25, 2025 Companies 4
Human View Machine View

4 companies named across 8 categories, one of 186 articles referencing Microsoft. Previous coverage: CISA issues best practices for Microsoft Exchange server security (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Data Processing & Outsourced Services

Our classification, not the publisher's statement. Best suited for, not only for.

Microsoft has issued a security update to fix a remote code execution vulnerability found in Windows Server Update Service (WSUS) affecting Windows Server versions 2012, 2016, 2019, 2022, and 2025. This flaw allows an unauthenticated actor to execute code remotely with SYSTEM-level privileges.

The vulnerability, identified as CVE-2025-59287, persists in WSUS despite earlier mitigations related to Decentralized Identity (DID). It specifically impacts WSUS components on Windows Server installations where the WSUS Server Role is active and listening on Transmission Control Protocol (TCP) ports 8530 or 8531. The advisory distinguishes this Common Vulnerabilities and Exposures (CVE) from previous updates by noting that prior patches DID not fully address the remote code execution risk.

Exploitation of this vulnerability permits an unauthenticated individual to gain remote SYSTEM-level code execution on affected servers. This escalation allows full control of the compromised system under the SYSTEM account privileges.

Microsoft released an out-of-band patch on October 23, 2025, resolving the vulnerability. Administrators must install this update and reboot WSUS servers to complete the remediation process. Organizations unable to apply the update promptly are advised to disable the WSUS Server Role or block inbound TCP traffic on ports 8530 and 8531 at the host firewall. These temporary measures should remain until the update is deployed, and all other Windows servers should also be updated and rebooted accordingly.

Detection recommendations include monitoring events for suspicious child processes with SYSTEM permissions spawned by wsusservice.exe or w3wp.exe, noting that some such processes may be legitimate. Alertness to nested PowerShell executions using base64-encoded commands is also advised since additional services may be involved in potential exploitation outside WSUS parent processes.

The Cybersecurity and Infrastructure Security Agency (CISA) has incorporated CVE-2025-59287 into its Known Exploited Vulnerabilities (KEV) Catalog and recommends applying Microsoft's guidance for this update. Organizations are encouraged to investigate network activity related to this vulnerability and are provided with additional resources from Huntress and Palo Alto Networks Unit 42 for further information.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-update-to-address-windows-server-update-service-remote-code-execution-vulnerability/",
        "name": "CISA issues update to address Windows Server Update Service remote code execution vulnerability",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-update-to-address-windows-server-update-service-remote-code-execution-vulnerability/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/microsoft/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/",
      "name": "Microsoft"
    },
    "articleSection": [
      "Cybersecurity",
      "Data Center",
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Data Processing & Outsourced Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:35:06-06:00",
    "datePublished": "2025-11-25T20:40:17-07:00",
    "description": "Microsoft issued a security update for Windows Server Update Service to fix a remote code execution flaw, CVE-2025-59287, across several Windows Server versions.",
    "headline": "CISA issues update to address Windows Server Update Service remote code execution vulnerability",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/alerts/2025/10/24/microsoft-releases-out-band-security-update-mitigate-windows-server-update-service-vulnerability-cve"
    },
    "keywords": [
      "Common Vulnerabilities and Exposures",
      "Known Exploited Vulnerabilities",
      "Server",
      "Transmission Control Protocol",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-update-to-address-windows-server-update-service-remote-code-execution-vulnerability/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/huntress/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/huntress/",
        "name": "Huntress"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/",
        "name": "Microsoft"
      },
      {
        "@id": "https://decisioninsights.ai/registry/palo-alto-networks/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/palo-alto-networks/",
        "name": "Palo Alto Networks"
      },
      {
        "@id": "https://decisioninsights.ai/projects/powershell/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/powershell/",
        "name": "PowerShell"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages