by Kastro CVE-2025-59287
Microsoft Windows Server 2012 — Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
Description · from the CVE record
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Affected
ProductAffectedFixed inSource
Windows Server 20126.2.9200.0 – < 6.2.9200.257286.2.9200.25728CNA
Windows Server 2012 (Server Core installation)6.2.9200.0 – < 6.2.9200.257286.2.9200.25728CNA
Windows Server 2012 R26.3.9600.0 – < 6.3.9600.228266.3.9600.22826CNA
Windows Server 2012 R2 (Server Core installation)6.3.9600.0 – < 6.3.9600.228266.3.9600.22826CNA
Windows Server 201610.0.14393.0 – < 10.0.14393.852410.0.14393.8524CNA
Windows Server 2016 (Server Core installation)10.0.14393.0 – < 10.0.14393.852410.0.14393.8524CNA
Windows Server 201910.0.17763.0 – < 10.0.17763.792210.0.17763.7922CNA
Windows Server 2019 (Server Core installation)10.0.17763.0 – < 10.0.17763.792210.0.17763.7922CNA
Windows Server 202210.0.20348.0 – < 10.0.20348.429710.0.20348.4297CNA
Windows Server 2022, 23H2 Edition (Server Core installation)10.0.25398.0 – < 10.0.25398.191610.0.25398.1916CNA
Windows Server 202510.0.26100.0 – < 10.0.26100.690510.0.26100.6905CNA
Windows Server 2025 (Server Core installation)10.0.26100.0 – < 10.0.26100.690510.0.26100.6905CNA
Scores by source
microsoft (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total