Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Exploitation has been observed and exploit details have been released for this WSUS remote code execution vulnerability. Immediate patching is recommended.

Exploit details have been released for this WSUS remote code execution vulnerability. Immediate patching is recommended.

The remote Windows host is missing security update 5070879, which addresses a remote code execution vulnerability in Windows Server Update Services (WSUS).

This plugin identifies vulnerable systems by performing the following checks:
  1. Validates the host is an affected Windows Server instance.
  2. Confirms the WSUS feature is installed by confirming the registry key 'Software\Microsoft\Update Services\' is present.
  3. Confirms the 'WsusService.exe' file exists to avoid false positives from incomplete uninstalls of the WSUS feature.
  4. If the service is present, it performs a version check on the 'Microsoft.UpdateServices.BaseApi.dll'      file to determine if the system has a patched file version.

ID	Name	Product	Family	Severity
271441	KB5070887: Windows Server 2012 WSUS RCE (CVE-2025-59287)	Nessus	Windows : Microsoft Bulletins	critical
271440	KB5070881: Windows Server 2025 WSUS RCE (CVE-2025-59287)	Nessus	Windows : Microsoft Bulletins	critical
271439	KB5070882: Windows Server 2016 WSUS RCE (CVE-2025-59287)	Nessus	Windows : Microsoft Bulletins	critical
271438	KB5070884: Windows Server 2022 WSUS RCE (CVE-2025-59287)	Nessus	Windows : Microsoft Bulletins	critical
271437	KB5070883: Windows Server 2019 WSUS RCE (CVE-2025-59287)	Nessus	Windows : Microsoft Bulletins	critical
271436	KB5070879: Windows Server 2022 23H2 WSUS RCE (CVE-2025-59287)	Nessus	Windows : Microsoft Bulletins	critical
271435	KB5070886: Windows Server 2012R2 WSUS RCE (CVE-2025-59287)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2025-59287

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical