CRITICAL 9.8 Microsoft PoC

CVE-2025-59287

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Microsoft Security Update 2025-Oct: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Affected Products

Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server 2025 (Server Core installation)
Windows Server 2022, 23H2 Edition (Server Core installation)
Windows Server 2025
Windows Server 2016

References

Published: 2025-10-14 · Source: Microsoft · Feed updated: 2026-09-24

This critical severity vulnerability with a CVSS score of 9.8 was published on 2025-10-14 via Microsoft. 🚨 A public proof-of-concept exploit is available on GitHub. EPSS score: 100.0% (top 0% of all CVEs by exploitation probability). Affected: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022 and 5 more.

Risk Timeline

CVE Disclosed2025-10-14 · 344 days ago

Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible

Remediation Resources

Official Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2025-59287

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2025-49708	Microsoft Graphics Component Elevation of Privilege Vulnerability	CRITICAL	9.9
CVE-2026-62815	Microsoft QUIC Remote Code Execution Vulnerability	CRITICAL	9.8
CVE-2026-62878	Windows DNS Server Remote Code Execution Vulnerability	CRITICAL	9.8
CVE-2026-62893	Windows Deployment Services TFTP Server Remote Code Execution Vulnerability	CRITICAL	9.8
CVE-2026-65791	Windows iSCSI Target Service Remote Code Execution Vulnerability	CRITICAL	9.8
CVE-2026-44815	DHCP Client Service Remote Code Execution Vulnerability	CRITICAL	9.8

vulnfeed aggregates 11940 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.