CISA orders feds to patch Windows Server WSUS flaw used in attacks

The Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. government agencies to patch a critical-severity Windows Server Update Services (WSUS) vulnerability after adding it to its catalog of security flaws exploited in attacks. Tracked as CVE-2025-59287, this actively exploited, potentially wormable remote code execution (RCE) vulnerability affects Windows servers with the WSUS Server role (a feature that isn't enabled by default) that act as update sources for other WSUS servers within the organization. Attackers can abuse it remotely in low-complexity attacks that don't require user interaction or privileges, allowing them to gain SYSTEM privileges and run malicious code. On Thursday, after cybersecurity firm HawkTrace Security released proof-of-concept exploit code, Microsoft released out-of-band security updates to "comprehensively address CVE-2025-59287" on all impacted Windows Server versions and advised IT administrators to install them as soon as possible. IT admins who can't immediately deploy the emergency patches are advised to disable the WSUS Server role on vulnerable systems to remove the attack vector. The day CVE-2025-59287 patches were released, American cybersecurity company Huntress found evidence of CVE-2025-59287 attacks targeting WSUS instances with their default ports (8530/TCP and 8531/TCP) exposed online. Dutch cybersecurity firm Eye Security also observed scanning and exploitation attempts on Friday morning, with at least one of its...