On October 14, 2025, Microsoft attempted to patch a critical unauthenticated RCE in Windows Server Update Services (WSUS). The fix proved incomplete, and an out-of-band (OOB) update was released on October 23, 2025. Within hours, multiple firms observed active exploitation in the wild against Internet-exposed WSUS over TCP 8530/8531. CISA added the bug to the KEV catalog on October 24, 2025, and urged rapid remediation. Risk is severe: pre-auth RCE as SYSTEM on a central patching service enables lateral movement and potential internal supply-chain abuse.
Following the release of Microsoft’s out-of-band (OOB) update on October 23, 2025, security firms including Huntress, Unit 42, and the Shadowserver Foundation observed immediate and widespread activity targeting internet-facing WSUS instances. Thousands of exposed servers were identified globally, and active scanning was reported by multiple sources, including the Dutch NCSC. The exploitation began within hours of the patch release, underscoring how quickly threat actors weaponized the vulnerability once technical details and proof-of-concept code were publicly available.
The likely method of ingress involves attackers sending crafted HTTP(S) POST requests to WSUS web services operating on the default ports 8530 and 8531. These requests trigger unsafe deserialization routines, leading to remote code execution on vulnerable systems.
Forensic evidence from compromised systems shows a consistent process chain: wsusservice.exe or w3wp.exe spawning cmd.exe, followed by powershell.exe execution. The PowerShell payloads typically run reconnaissance commands such as whoami, net user /domain, and ipconfig /all, then exfiltrate results to remote endpoints—often hosted on legitimate services like webhook[.]site.
A successful compromise of WSUS gives an attacker domain-wide reach and control. Because WSUS is responsible for distributing trusted software updates, a compromised server could push malicious updates across the enterprise, effectively turning a central patch-management system into a vector for internal supply-chain attacks. In addition, an internet-exposed WSUS instance magnifies the risk by allowing unauthenticated, remote exploitation without user interaction.
Microsoft released an out-of-band update on October 23, 2025, addressing the vulnerability across all supported Windows Server versions. Organizations should install this patch immediately and reboot affected systems to ensure full remediation.
If patching cannot be performed right away, Microsoft and CISA recommend temporary mitigations to remove the attack vector. These include disabling the WSUS role on affected servers and/or blocking inbound traffic to ports 8530 and 8531 on host and network firewalls. These mitigations should remain in place until the patch has been successfully applied and verified.
If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively Get in touch to find out how you can protect your organisation.