WSUS flaw allows remote code execution via deserialization
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical deserialization vulnerability in Windows Server Update Services enables unauthenticated remote code execution; actively exploited.
A critical deserialization vulnerability in Microsoft Windows Server Update Services (WSUS) allows remote code execution without user interaction. An attacker can send a specially crafted event to a vulnerable WSUS server to execute arbitrary code with system-level privileges, potentially gaining full control of the WSUS infrastructure and distributing malicious updates to all connected client devices across an organization's network. The vulnerability affects multiple Windows Server versions including 2012 R2, 2012, 2016, 2019, 2022, and 2025. Proof-of-concept exploit code has been publicly released and CISA has added CVE-2025-59287 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Microsoft released an out-of-band security update on October 23, 2025. Organizations unable to patch immediately should disable the WSUS Server Role or block inbound access to ports TCP 8530 and TCP 8531. Detection should focus on suspicious child processes spawned from wsusservice.exe or w3wp.exe with SYSTEM-level permissions and nested base64-encoded PowerShell commands.
Mentioned in this report
Detection guidance
Shell or LOLBin Spawned by WSUS Service Process
wsusservice.exe spawning a command interpreter or common LOLBin, consistent with CVE-2025-59287 WSUS deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell or LOLBin Spawned by WSUS Service Process
id: 29b9381b-34a2-5a53-88cb-b889d4e749c8
status: experimental
description: Detects wsusservice.exe spawning command interpreters or common living-off-the-land
binaries. This is the post-exploitation pattern of the WSUS deserialization RCE
(CVE-2025-59287), where code executes as SYSTEM in the WSUS service context.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \wsusservice.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \rundll32.exe
- \regsvr32.exe
- \whoami.exe
- \net.exe
- \net1.exe
condition: selection
falsepositives:
- Rare administrator troubleshooting scripts launched by a custom WSUS service wrapper
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-windows-server-update-services-wsus-could-allow-for-remote-code-execution_2025-099
Shell Spawned by IIS Worker Process Running the WSUS Application Pool
w3wp.exe hosting the WsusPool application pool spawning shells or LOLBins, indicating exploitation of the WSUS web services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned by IIS Worker Process Running the WSUS Application Pool
id: 5eaad500-6547-5f86-9124-797a84d3f3b3
status: experimental
description: Detects the IIS worker process serving the WSUS application pool (WsusPool)
spawning command interpreters or LOLBins. Matches the WSUS deserialization RCE (CVE-2025-59287)
child-process behaviour sent to TCP 8530/8531.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: WsusPool
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \rundll32.exe
- \regsvr32.exe
- \whoami.exe
- \net.exe
- \net1.exe
condition: selection
falsepositives:
- Rare administrator diagnostic scripts run under the WSUS application pool identity
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-windows-server-update-services-wsus-could-allow-for-remote-code-execution_2025-099
Encoded PowerShell Launched from WSUS Service or WSUS IIS Worker
PowerShell with an encoded command launched by wsusservice.exe or the WSUS IIS app pool worker, matching reported nested base64 payloads after WSUS RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Encoded PowerShell Launched from WSUS Service or WSUS IIS Worker
id: a4ca0f47-5b76-5809-aa39-b5c9ed32ef75
status: experimental
description: Detects PowerShell started with an encoded command by wsusservice.exe
or a w3wp.exe worker for the WSUS app pool. Post-exploitation of CVE-2025-59287
has been observed using nested base64-encoded PowerShell commands.
tags:
- attack.execution
- attack.t1059.001
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent_svc:
ParentImage|endswith: \wsusservice.exe
selection_parent_iis:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: WsusPool
selection_child:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains|windash:
- ' -enc'
- ' -e '
- ' -ec '
condition: 1 of selection_parent_* and selection_child
falsepositives:
- Custom WSUS maintenance automation that launches encoded PowerShell from the WSUS
service context
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-windows-server-update-services-wsus-could-allow-for-remote-code-execution_2025-099
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-windows-server-update-services-wsus-could-allow-for-remote-code-execution_2025-099
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs