Critical vulnerability in Microsoft Windows Server Update Service (WSUS)

This alert has been written primarily for, but is not limited to, business and government.

This alert is intended for a technical audience.

Background

Microsoft has identified the following vulnerability in the Microsoft Windows Server Update Service:

• CVE-2025-59287: This vulnerability involves deserialisation of untrusted data in WSUS, which could enable an unauthenticated actor to achieve remote code execution with system privileges. The ASD’s ACSC recommends that organisations take immediate action to address affected products.
• The vulnerability impacts Microsoft Windows Server Update Service in Windows Server (2012, 2016, 2019, 2022 and 2025).

Mitigation advice

Australian organisations should review their networks for use of vulnerable instances of the Windows Server Update Service (WSUS), and consult the Microsoft Security Update guide for mitigation advice.

Where to get help

Organisations that have been impacted, suspect impact or require advice and assistance can contact us via 1300 CYBER1 (1300 292 371).