Summary
Updated October 29, 2025 : CISA has updated this Alert to include revised information on vulnerable product identification, potential threat activity detections, and additional resources. Microsoft released an update to address a critical remote code execution vulnerability impacting Windows Server Update Service (WSUS) in Windows Server (2012, 2016, 2019, 2022, and 2025), CVE-2025-59287 , that a prior update did not fully mitigate. CISA strongly urges organizations to implement Microsoft’s updated Windows Server Update Service (WSUS) Remote Code Execution Vulnerability guidance, 1 or risk an unauthenticated actor achieving remote code execution with SYSTEM-level privileges. Immediate actions for organizations with affected products are: Identify servers vulnerable to exploitation (i.e., affected servers with WSUS Server Role enabled and ports open to TCP 8530/TCP 8531) for priority mitigation: Run the following command in PowerShell to check if WSUS is in an installed state: Get-WindowsFeature -Name UpdateServices ; and/or Leverage the Server Manager Dashboard, and check if WSUS enablement is turned on as a Server Role. Run the following command in PowerShell to check if WSUS is in an installed state: Get-WindowsFeature -Name UpdateServices ; and/or Leverage the Server Manager Dashboard, and check if WSUS enablement is turned on as a Server Role.