PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-59287 Microsoft CVE debrief

CVE-2025-59287 is a Microsoft Windows Server Update Service (WSUS) deserialization of untrusted data vulnerability. CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-24, which signals active exploitation and makes remediation an urgent priority for Windows environments that run WSUS.

Vendor
Microsoft
Product
Windows
CVSS
CRITICAL 9.8
CISA KEV
Listed
Original CVE published
2025-10-24
Original CVE updated
2025-10-24
Advisory published
2025-10-24
Advisory updated
2025-10-24

Who should care

Windows administrators, infrastructure and patch-management teams running WSUS, SOC analysts, and security teams responsible for Microsoft server environments.

Technical summary

The issue is identified as a deserialization of untrusted data weakness in WSUS. The supplied corpus does not include deeper exploit mechanics or a CVSS score, but the CISA KEV listing confirms known exploitation in the wild.

Defensive priority

Critical

Recommended defensive actions

  • Review Microsoft's advisory and update guidance for CVE-2025-59287 and apply the vendor-recommended mitigation or update as soon as possible.
  • Prioritize remediation for every WSUS deployment, especially systems that are broadly reachable or exposed beyond tightly controlled administrative networks.
  • If mitigations are not available for a deployment, follow CISA guidance to discontinue use of the product until it can be secured.
  • Monitor WSUS servers and adjacent Windows infrastructure for unusual behavior and validate patch-management integrity after remediation.
  • Use the CISA KEV due date of 2025-11-14 as an internal urgency marker for any outstanding remediation work.

Evidence notes

CISA's KEV metadata lists Microsoft Windows / WSUS for this CVE, with dateAdded 2025-10-24 and dueDate 2025-11-14. CISA's required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The supplied official links also include the CVE record, NVD entry, and CISA KEV catalog.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-59287 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-59287

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-59287 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-59287

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.