Microsoft drops surprise Windows Server patch before weekend downtime
(2025/10/24)
- Reference: 1761308186
- News link: https://www.theregister.co.uk/2025/10/24/windows_server_patch/
- Source link:
Microsoft has released an out-of-band update to patch a critical vulnerability in Windows Server Update Services (WSUS).
The update addresses [1]CVE-2025-59287">CVE-2025-59287 , a remote code execution flaw affecting Windows Server versions 2012 through 2025. The vulnerability stems from insecure deserialization of untrusted data, allowing unauthenticated attackers to execute arbitrary code. A proof-of-concept exploit is publicly available.
The vulnerability has been assigned a maximum severity level of "critical". Only servers with the WSUS role enabled are affected.
[2]
Microsoft recommends admins unable to immediately patch should disable the role on affected servers - although this will obviously prevent client updates from the server. Or they can choose to block inbound traffic to ports 8530 and 8531 on the host firewall to stop WSUS working.
[3]
[4]
The update is cumulative and includes October's patches if not yet installed. A reboot is required.
Windows is chock-full of legacy code waiting to be abused by attackers, however, anything that could result in remote code execution requires swift resolution or mitigation. This particular issue relates to a "legacy serialization mechanism," according to Microsoft.
[5]Frightful Patch Tuesday gives admins a scare with 175+ Microsoft CVEs, 3 under attack
[6]Microsoft admits to Intune forgetfulness
[7]Windows Server Update Services live to patch another day
[8]Your days of driver sync via Windows Server Update Services are numbered
WSUS is on the [9]deprecated list for Windows Server, which means it is no longer being actively developed but remains a supported part of the operating system. Microsoft recently [10]confirmed it would continue supporting driver update synchronization to WSUS following user outcry over plans to end support in April 2025.
However Microsoft's message to administrators is clear: switch to an alternative like its cloud-based Intune service.
[11]
Ultimately, an out-of-band update is serious business, particularly for a deprecated Windows component. While no removal date has been announced, this critical vulnerability raises questions about WSUS's long-term viability. ®
Get our [12]Tech Resources
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aPuilBC6JDRJmtF5MO9cGAAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aPuilBC6JDRJmtF5MO9cGAAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aPuilBC6JDRJmtF5MO9cGAAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2025/10/14/microsoft_october_2025_patch_tuesday/
[6] https://www.theregister.com/2025/07/01/microsoft_intune_forgetfulness/
[7] https://www.theregister.com/2025/04/08/microsoft_wsus_extended_support/
[8] https://www.theregister.com/2025/02/19/wsus_drive_sync_deprecated/
[9] https://www.theregister.com/2024/09/23/microsoft_wsus_deprecation/
[10] https://www.theregister.com/2025/04/08/microsoft_wsus_extended_support/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aPuilBC6JDRJmtF5MO9cGAAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
The update addresses [1]CVE-2025-59287">CVE-2025-59287 , a remote code execution flaw affecting Windows Server versions 2012 through 2025. The vulnerability stems from insecure deserialization of untrusted data, allowing unauthenticated attackers to execute arbitrary code. A proof-of-concept exploit is publicly available.
The vulnerability has been assigned a maximum severity level of "critical". Only servers with the WSUS role enabled are affected.
[2]
Microsoft recommends admins unable to immediately patch should disable the role on affected servers - although this will obviously prevent client updates from the server. Or they can choose to block inbound traffic to ports 8530 and 8531 on the host firewall to stop WSUS working.
[3]
[4]
The update is cumulative and includes October's patches if not yet installed. A reboot is required.
Windows is chock-full of legacy code waiting to be abused by attackers, however, anything that could result in remote code execution requires swift resolution or mitigation. This particular issue relates to a "legacy serialization mechanism," according to Microsoft.
[5]Frightful Patch Tuesday gives admins a scare with 175+ Microsoft CVEs, 3 under attack
[6]Microsoft admits to Intune forgetfulness
[7]Windows Server Update Services live to patch another day
[8]Your days of driver sync via Windows Server Update Services are numbered
WSUS is on the [9]deprecated list for Windows Server, which means it is no longer being actively developed but remains a supported part of the operating system. Microsoft recently [10]confirmed it would continue supporting driver update synchronization to WSUS following user outcry over plans to end support in April 2025.
However Microsoft's message to administrators is clear: switch to an alternative like its cloud-based Intune service.
[11]
Ultimately, an out-of-band update is serious business, particularly for a deprecated Windows component. While no removal date has been announced, this critical vulnerability raises questions about WSUS's long-term viability. ®
Get our [12]Tech Resources
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aPuilBC6JDRJmtF5MO9cGAAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aPuilBC6JDRJmtF5MO9cGAAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aPuilBC6JDRJmtF5MO9cGAAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2025/10/14/microsoft_october_2025_patch_tuesday/
[6] https://www.theregister.com/2025/07/01/microsoft_intune_forgetfulness/
[7] https://www.theregister.com/2025/04/08/microsoft_wsus_extended_support/
[8] https://www.theregister.com/2025/02/19/wsus_drive_sync_deprecated/
[9] https://www.theregister.com/2024/09/23/microsoft_wsus_deprecation/
[10] https://www.theregister.com/2025/04/08/microsoft_wsus_extended_support/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aPuilBC6JDRJmtF5MO9cGAAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
Re: Context, wot's that?
LVPC
>> However Microsoft's message to administrators is clear: switch to an alternative like its cloud-based Intune service.
People still use Microsoft for servers? What sort of insanity in this day and age!
Only a serious vulnerability if you've already lost your mind.
may_i
> block inbound traffic to ports 8530 and 8531
Why would anyone, except for reasons of insanity, expose ANY ports on a Windows machine to the Internet at large?
Re: Only a serious vulnerability if you've already lost your mind.
Jou (Mxyzptlk)
Because there is another way more common reason: Stupidity. Worse that insanity.
Anonymous Coward
"However Microsoft's message to administrators is clear: switch to an alternative like its cloud-based Intune service."
Intune can only be used for client versions of Windows. If you use WSUS to update servers then the cloudy equivalent for them is Azure Update Manager, which is part of Azure Arc.
"If the WSUS Server Role is enabled on your server, disable it."
Jou (Mxyzptlk)
"If the WSUS Server Role is enabled on your server, disable it. Note that clients will no longer receive updates from the server if WSUS is disabled."
Gotta love that humor in the msrc article...
At least it is included int the normal updates for Windows server and not a separate patch...
Context, wot's that?
"However Microsoft's message to administrators is clear: switch to an alternative"