CVE-2025-59287: Actionable Report for SOC Teams

CVE-2025-59287 Analysis

Huntress observed threat actors exploiting an unauthenticated deserialization RCE in Windows Server Update Services (CVE-2025-59287) on publicly exposed ports 8530/TCP and 8531/TCP, spawning cmd.exe and powershell.exe to enumerate system information and exfiltrate it via a remote webhook.

CVE-2025-59287 Vulnerability

CVE-2025-59287 is a critical (CVSS 9.8) unauthenticated remote-code-execution flaw in Microsoft Windows Server Update Services (WSUS) caused by unsafe deserialization of an AuthorizationCookie (the service used .NET’s insecure BinaryFormatter), allowing a remote attacker with network access to the WSUS service (commonly on TCP 8530/8531 or 80/443) to execute arbitrary code as the WSUS process, deploy web shells or multi-stage payloads, and establish persistent C2.

The bug has been observed exploited in the wild and a public PoC exists; Microsoft issued an out-of-band fix on October 23, 2025, and interim mitigations include disabling the WSUS Server role or blocking inbound access to WSUS management ports until patched.

CVE-2025-59287 Mitigation

Apply Microsoft’s out-of-band WSUS update immediately (October 23, 2025 patch/KB).

If you cannot patch right away, disable the WSUS Server role or block inbound network access to WSUS management ports (default TCP 8530/8531 and other exposed management ports) and restrict WSUS to a trusted management network to prevent external exploitation.

After patching, hunt for indicators of compromise, review WSUS and Windows event logs, rotate any credentials that may have been exposed, and rebuild any systems confirmed or suspected to be compromised; follow CISA/KEV guidance and organizational incident-response procedures for reporting and remediation.

CVE-2025-59287 Simulation

Executive Summary

Test Case ID: TC-20251027-A1B2C
TTPs: T1210, T1059.001, T1218.012, T1057, T1036.009
Detection Rule Logic Summary: Detects process chains where wsusservice.exe or w3wp.exe spawn a cmd.exe process that subsequently launches both another cmd.exe and a powershell.exe child.
Detection Rule Language/Format: Sigma (YAML)
Target Security Environment:

• OS: Windows 10/Server 2019 (Windows OS)
• Logging: Windows Event Log – Process Creation (Event ID 4688) or Sysmon (Event ID 1)
• Security Stack: Generic SIEM (e.g., Microsoft Sentinel, Splunk, Elastic) capable of parsing Sigma rules

Resilience Score (1-5): 3
Justification: The rule is fairly specific to…