CVE-2025-59287 is a critical deserialisation vulnerability in Windows Server Update Services, the component organisations use to centrally manage and distribute updates. Following public disclosure and reports of active exploitation, it drew immediate attention — because of how privileged WSUS is, and how widely it is deployed.
WSUS is deeply integrated with IIS and usually runs with elevated permissions, so successful exploitation means arbitrary code execution on a piece of core infrastructure. This is how the vulnerability is abused, what exploitation looks like in telemetry, and how to hunt for it using behaviour rather than signatures.
How the vulnerability works
CVE-2025-59287 is caused by unsafe deserialisation of attacker-controlled input within WSUS components hosted under IIS. Exploitation follows a consistent shape:
- A specially crafted request reaches a vulnerable WSUS endpoint.
- The request carries serialised data designed to trigger execution as it is deserialised.
- WSUS processes that input using its elevated service privileges.
- Attacker-controlled commands execute — frequently without anything being written to disk.
No valid credentials are required. And because WSUS is trusted by every endpoint that takes updates from it, a foothold there is a privileged one.
Three properties make WSUS an attractive target at once: it is often reachable, it is highly trusted by endpoints, and it runs with elevated privileges.
What exploitation looks like
Unlike a conventional malware infection, exploitation here often involves no file drops at all. Attackers lean on living-off-the-land techniques, driving PowerShell and system commands through legitimate Windows services — which is precisely what makes signature-based detection ineffective against it.
In practice it surfaces as process relationships that should never occur:
wsusservice.exespawning PowerShell orcmd.exew3wp.exe, the IIS worker process, launching a scripting engine- Encoded PowerShell —
powershell -ec— used to frustrate inspection
Under normal operation WSUS does not spawn interactive shells or scripting engines. That is the whole detection: these parent–child relationships are not suspicious by degree, they are simply wrong.
A hunting methodology
Exploitation techniques evolve faster than indicator lists. File hashes and IP addresses go stale within days, so the hunt is built on a behavioural hypothesis instead:
If CVE-2025-59287 is being exploited, WSUS or IIS services will spawn unauthorised child processes.
From that hypothesis:
- Monitor parent–child process relationships involving WSUS and IIS.
- Review command-line arguments for encoded or obfuscated execution.
- Focus on abnormal behaviour rather than known-bad artefacts.
The value of this framing is that it survives the attacker changing payload, tooling or infrastructure. The behaviour it describes is intrinsic to the technique, not to one campaign.
What it needs from your telemetry
- High-quality process creation events
- Visibility into parent–child relationships
- Full command-line logging
Microsoft Defender for Endpoint provides all three, and the principles here apply to any platform that does.
MITRE ATT&CK mapping
- T1190 — Exploit Public-Facing Application. Abuse of an exposed WSUS service to trigger unsafe deserialisation and achieve remote code execution.
- T1059.001 — Command and Scripting Interpreter: PowerShell. PowerShell as the post-exploitation mechanism for payload delivery and command execution.
- T1059 — Command and Scripting Interpreter. General execution of attacker-supplied commands through compromised WSUS or IIS processes.
- T1047 — Windows Management Instrumentation. WMI as a route to remote execution, persistence or follow-on activity.
Prevention
- Patch promptly. Ensure WSUS and the underlying Windows Server components are fully updated as soon as fixes are released.
- Restrict exposure. A WSUS server should not be reachable from the internet unless there is a specific reason. Constrain access with firewalls, segmentation and allow-lists.
- Harden IIS. Disable unused features, enforce TLS properly, and monitor the application pools associated with WSUS.
- Apply least privilege. Limit administrative access to WSUS servers, and give service accounts only what they need to run.
- Turn on the logging the hunt depends on. Detailed process and command-line logging is not optional here — without it the behavioural detections above cannot fire.
Remediation
Where exploitation is suspected or confirmed, containment comes first:
- Isolate the affected system to prevent lateral movement.
- Terminate malicious processes — any unauthorised PowerShell, cmd or WMI activity spawned by WSUS or IIS.
- Rotate credentials and secrets, including service accounts and any privileged accounts that may have been exposed.
- Review system integrity for persistence: scheduled tasks, services, registry modifications, WMI event subscriptions.
- Rebuild where confidence is high. For a compromised WSUS server, rebuilding from a trusted baseline is usually the safest outcome.
The broader trend
Exploitation of a service like WSUS reflects where modern intrusions are going: away from end-user devices and towards the trusted, high-privilege systems that manage them.
- Increased targeting of public-facing and management services
- A preference for living-off-the-land techniques over custom malware
- Exploitation that escalates to enterprise-wide impact quickly, because the compromised system was trusted by everything
Attackers are concentrating on vulnerabilities that offer centralised control, because that is where the effort-to-impact ratio is best. Update infrastructure is close to the top of that list — it is trusted by every endpoint in the estate by design.
Affected and related technologies
- Windows Server Update Services — the affected service
- Internet Information Services — the hosting and execution layer
- Windows Server — the underlying infrastructure
- PowerShell and cmd — common post-exploitation execution
- Windows Management Instrumentation — a route to persistence and remote execution
- EDR platforms such as Microsoft Defender for Endpoint — where the exploitation behaviour becomes visible