Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

PoC Exploit Released for Windows Server Update Services Remote Code Execution Vulnerability

## Cybersecurity: WSUS Remote Code Execution Vulnerability

RBy Robert LangleyOct 20, 20252 min read

Cybersecurity: WSUS Remote Code Execution Vulnerability

A critical vulnerability has been identified in Microsoft's Windows Server Update Services (WSUS), allowing unauthenticated attackers to execute remote code with SYSTEM privileges on affected servers.

The vulnerability, designated as CVE-2025-59287 with a CVSS v3.1 score of 9.8, results from unsafe deserialization of untrusted data in WSUS's AuthorizationCookie handling.

Disclosed during Microsoft's October 2025 Patch Tuesday, this flaw poses significant risks to enterprise update infrastructures, potentially allowing widespread compromise.

WSUS is a server role in Windows Server that aids IT administrators in deploying Microsoft updates across networks. Despite being deprecated for new features, WSUS remains widely used and continues to receive security support.

The vulnerability affects all supported Windows Server versions from 2012 to 2025. It is rooted in the GetCookie() endpoint, which processes encrypted AuthorizationCookie objects without adequate validation.

WSUS is a server role in Windows Server that aids IT administrators in deploying Microsoft updates across networks.
Robert Langley · Thehackingpost

At its core, CVE-2025-59287 exploits a deserialization issue in the EncryptionHelper.DecryptData() method. Incoming cookie data is decrypted and directly passed to .NET's BinaryFormatter for deserialization. This legacy serializer lacks type restrictions, allowing attackers to craft malicious payloads capable of arbitrary code execution.

The exploit involves an unauthenticated HTTP POST request to the WSUS ClientWebService endpoint on port 8530. Attackers send a SOAP envelope containing a tampered AuthorizationCookie with encrypted payload data.

The server decrypts the cookie using a hardcoded key, strips the IV block, and deserializes the result via BinaryFormatter. A proof-of-concept (PoC) shared by researcher "hawktrace" on GitHub demonstrates how to generate payloads that launch commands such as "calc.exe".

Microsoft has released security updates as part of the October 2025 patch cycle. Organizations are advised to apply these updates promptly via Windows Update or WSUS.

Advertisement

Additional security measures include isolating WSUS servers, enabling firewalls to restrict access, and monitoring for anomalous SOAP traffic. Long-term, it is recommended to migrate from BinaryFormatter to safer alternatives like JSON or XML serializers with strict validation.

Timely patching is crucial to prevent potential supply-chain attacks and protect against broader network breaches.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026