CVE-2025-59287

9.8 Critique Exploitée activement

Publiée le 14/10/2025 à 19:16 · Modifiée le 17/06/2026 à 11:45 · Analysée par le NVD · Source : secure@microsoft.com

Catalogue CISA KEV — Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Ajoutée le 24/10/2025 · Échéance de correction (agences US) : 14/11/2025

Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	secure@microsoft.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-502

Références

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 Vendor Advisory
https://hawktrace.com/blog/CVE-2025-59287 ExploitThird Party Advisory
https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/ Press/Media Coverage
https://www.vicarius.io/vsociety/posts/cve-2025-59287-detection-script-rce-vulnerability-in-windows-server-update-service Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-59287-mitigation-script-rce-vulnerability-in-windows-server-update-service MitigationThird Party Advisory
https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59287 Third Party AdvisoryUS Government Resource

CVE-2025-59287

Catalogue CISA KEV — Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs