CRITICAL 9.8 Microsoft PoC

CVE-2025-59287

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Microsoft Security Update 2025-Oct: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Affected Products

Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server 2025 (Server Core installation)
Windows Server 2022, 23H2 Edition (Server Core installation)
Windows Server 2025
Windows Server 2016

References

Published: 2025-10-14 · Source: Microsoft · Feed updated: 2026-08-10

This critical severity vulnerability with a CVSS score of 9.8 was published on 2025-10-14 via Microsoft. 🚨 A public proof-of-concept exploit is available on GitHub. EPSS score: 99.9% (top 0% of all CVEs by exploitation probability). Affected: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022 and 5 more.

Risk Timeline

CVE Disclosed2025-10-14 · 299 days ago

Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible

Remediation Resources

Official Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2025-59287

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	CRITICAL	9.9
CVE-2025-49708	Microsoft Graphics Component Elevation of Privilege Vulnerability	CRITICAL	9.9
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	CRITICAL	9.8
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	CRITICAL	9.8
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	CRITICAL	9.8
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	CRITICAL	9.8

vulnfeed aggregates 8893 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.