Home
Description
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
PUBLISHED Reserved 2025-09-11 | Published 2025-10-14 | Updated 2025-10-15 | Assigner microsoft
CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Problem types
CWE-502: Deserialization of Untrusted Data
Product status
10.0.17763.0 before 10.0.17763.7919
affected
10.0.17763.0 before 10.0.17763.7919
affected
10.0.20348.0 before 10.0.20348.4294
affected
10.0.26100.0 before 10.0.26100.6899
affected
10.0.25398.0 before 10.0.25398.1913
affected
10.0.26100.0 before 10.0.26100.6899
affected
10.0.14393.0 before 10.0.14393.8519
affected
10.0.14393.0 before 10.0.14393.8519
affected
6.2.9200.0 before 6.2.9200.25722
affected
6.2.9200.0 before 6.2.9200.25722
affected
6.3.9600.0 before 6.3.9600.22824
affected
6.3.9600.0 before 6.3.9600.22824
affected
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 (Windows Server Update Service (WSUS) Remote Code Execution Vulnerability) vendor-advisory
cve.org
(CVE-2025-59287)
nvd.nist.gov
(CVE-2025-59287)
Download JSON
