Cybersecurity researchers have warned that attackers are actively exploiting a severe vulnerability in Windows Server Update Services (WSUS), even after Microsoft’s recent patch failed to fully fix the issue. The flaw, tracked as CVE-2025-59287, impacts WSUS versions dating back to 2012.
Microsoft rolled out an emergency out-of-band security update for the vulnerability on Thursday, following earlier attempts to address it. Despite this, several cybersecurity firms reported active exploitation by Friday. However, Microsoft has not yet officially confirmed these attacks.
This situation highlights how quickly both cyber defenders and adversaries respond to newly disclosed flaws. Within hours of Microsoft’s emergency patch release, researchers observed proof-of-concept exploits and live attacks targeting vulnerable servers.
“This vulnerability shows how simple and trivial exploitation is once an attack script is publicly available,” said John Hammond, principal security researcher at Huntress, in an interview with CyberScoop. “It’s always an attack of opportunity — just kind of spray-and-pray, and see whatever access a criminal can get their hands on.”
The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, urging organizations to apply the latest patch and adhere to Microsoft’s mitigation steps.
A Microsoft spokesperson confirmed the re-release of the patch, explaining: “We re-released this CVE after identifying that the initial update did not fully mitigate the issue. Customers who have installed the latest updates are already protected.” Microsoft did not specify when or how it discovered that the previous patch was insufficient.
According to Shadowserver, over 2,800 instances of WSUS with open ports (8530 and 8531) are exposed to the internet — a necessary condition for exploitation. Approximately 28% of these vulnerable systems are located in the United States.
“Exploitation of this flaw is indiscriminate,” warned Ben Harris, founder and CEO of watchTowr. “If an unpatched Windows Server Update Services instance is online, at this stage it has likely already been compromised. This isn’t limited to low-risk environments — some of the affected entities are exactly the types of targets attackers prioritize.”
Huntress has observed five active attack cases linked to CVE-2025-59287. Hammond explained that these incidents mostly involve reconnaissance activities — such as environment mapping and data exfiltration — with no severe damage observed so far. However, he cautioned that WSUS operates with high-level privileges, meaning successful exploitation could fully compromise the affected server.
The risk, Hammond added, could escalate into supply chain attacks, where adversaries push malicious updates to connected systems. “Some potential supply-chain shenanigans just opening the door with this opportunity,” he said.
Experts from Palo Alto Networks’ Unit 42 echoed the concern. “By compromising this single server, an attacker can take over the entire patch distribution system,” said Justin Moore, senior manager of threat intel research at Unit 42. “With no authentication, they can gain system-level control and execute a devastating internal supply chain attack. They can push malware to every workstation and server in the organization, all disguised as a legitimate Microsoft update. This turns the trusted service into a weapon of mass distribution.”
Security researchers continue to emphasize that WSUS should never be exposed to the public internet, as attackers cannot exploit the flaw in instances that restrict external access.
Microsoft deprecated WSUS in September, stating that while it will still receive security support, it is no longer under active development or set to gain new features.