ctrlINT What the industry said about every indicator, with the quote

CVE-2025-59287Vulnerability

Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 2 independent sources · first reported by Huntress · last reported

Last reported 7 months ago

CISA KEVAdded 24 Oct 2025
Fix due 14 Nov 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 26 Sep 2026

What the reports say

4 reports, newest first · the exact sentence from each

  1. “Shohei Iwata and Teruki Yoshikawa presented an in-depth analysis of an attack exploiting the WSUS RCE vulnerability (CVE-2025-59287).”

    JPCERT/CC EyesGovernment
    JSAC2026 -Day 2-

  2. “…garding exploited vulnerabilities does harken back to part one of this series, where the threat actor targeted a WSUS vulnerability (CVE-2025-59287) to gain initial access.”

    HuntressVendor
    Velociraptor Misuse, Pt. II: The Eye of the Storm

  3. “After gaining initial access via exploitation of the flaw (CVE-2025-59287), the actors then installed Velociraptor, a legitimate, open source tool, which was used for C2 of the endpoint.”

    HuntressVendor
    Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?

  4. “Exploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287)”

    HuntressVendor
    Exploitation of Windows Server Update Services Remote Code

Indicators reported together

named in the same reports
Copy these 14 indicators · defanged

Also named with it: CVE-2025-53770, CVE-2025-49706, CVE-2025-49704, CVE-2025-53771

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2025-59287 here?
No account needed. We do not store your IP address.