# WSUS flaw allows remote code execution via deserialization

Published: 2026-06-09 · Severity: high · Sectors: government-national, technology
Canonical: https://vorant.io/reports/8a7118cc-fec1-58b7-af70-11c4e027361a/wsus-flaw-allows-remote-code-execution-via-deserialization

> Critical deserialization vulnerability in Windows Server Update Services enables unauthenticated remote code execution; actively exploited.

A critical deserialization vulnerability in Microsoft Windows Server Update Services (WSUS) allows remote code execution without user interaction. An attacker can send a specially crafted event to a vulnerable WSUS server to execute arbitrary code with system-level privileges, potentially gaining full control of the WSUS infrastructure and distributing malicious updates to all connected client devices across an organization's network. The vulnerability affects multiple Windows Server versions including 2012 R2, 2012, 2016, 2019, 2022, and 2025. Proof-of-concept exploit code has been publicly released and CISA has added CVE-2025-59287 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Microsoft released an out-of-band security update on October 23, 2025. Organizations unable to patch immediately should disable the WSUS Server Role or block inbound access to ports TCP 8530 and TCP 8531. Detection should focus on suspicious child processes spawned from wsusservice.exe or w3wp.exe with SYSTEM-level permissions and nested base64-encoded PowerShell commands.

## Mentioned in this report

- Vulnerabilities: CVE-2025-59287 (KEV)

## Detection guidance (public sample)

### Shell or LOLBin Spawned by WSUS Service Process

ATT&CK: T1190

wsusservice.exe spawning a command interpreter or common LOLBin, consistent with CVE-2025-59287 WSUS deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shell or LOLBin Spawned by WSUS Service Process
id: 29b9381b-34a2-5a53-88cb-b889d4e749c8
status: experimental
description: Detects wsusservice.exe spawning command interpreters or common living-off-the-land
  binaries. This is the post-exploitation pattern of the WSUS deserialization RCE
  (CVE-2025-59287), where code executes as SYSTEM in the WSUS service context.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \wsusservice.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
  condition: selection
falsepositives:
- Rare administrator troubleshooting scripts launched by a custom WSUS service wrapper
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-windows-server-update-services-wsus-could-allow-for-remote-code-execution_2025-099
```

### Shell Spawned by IIS Worker Process Running the WSUS Application Pool

ATT&CK: T1190

w3wp.exe hosting the WsusPool application pool spawning shells or LOLBins, indicating exploitation of the WSUS web services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shell Spawned by IIS Worker Process Running the WSUS Application Pool
id: 5eaad500-6547-5f86-9124-797a84d3f3b3
status: experimental
description: Detects the IIS worker process serving the WSUS application pool (WsusPool)
  spawning command interpreters or LOLBins. Matches the WSUS deserialization RCE (CVE-2025-59287)
  child-process behaviour sent to TCP 8530/8531.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: WsusPool
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
  condition: selection
falsepositives:
- Rare administrator diagnostic scripts run under the WSUS application pool identity
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-windows-server-update-services-wsus-could-allow-for-remote-code-execution_2025-099
```

### Encoded PowerShell Launched from WSUS Service or WSUS IIS Worker

ATT&CK: T1059.001

PowerShell with an encoded command launched by wsusservice.exe or the WSUS IIS app pool worker, matching reported nested base64 payloads after WSUS RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Encoded PowerShell Launched from WSUS Service or WSUS IIS Worker
id: a4ca0f47-5b76-5809-aa39-b5c9ed32ef75
status: experimental
description: Detects PowerShell started with an encoded command by wsusservice.exe
  or a w3wp.exe worker for the WSUS app pool. Post-exploitation of CVE-2025-59287
  has been observed using nested base64-encoded PowerShell commands.
tags:
- attack.execution
- attack.t1059.001
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_svc:
    ParentImage|endswith: \wsusservice.exe
  selection_parent_iis:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: WsusPool
  selection_child:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|windash:
    - ' -enc'
    - ' -e '
    - ' -ec '
  condition: 1 of selection_parent_* and selection_child
falsepositives:
- Custom WSUS maintenance automation that launches encoded PowerShell from the WSUS
  service context
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-windows-server-update-services-wsus-could-allow-for-remote-code-execution_2025-099
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-windows-server-update-services-wsus-could-allow-for-remote-code-execution_2025-099

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8a7118cc-fec1-58b7-af70-11c4e027361a/wsus-flaw-allows-remote-code-execution-via-deserialization.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup